1 /*
2 * WPA/RSN - Shared functions for supplicant and authenticator
3 * Copyright (c) 2002-2018, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "crypto/md5.h"
13 #include "crypto/sha1.h"
14 #include "crypto/sha256.h"
15 #include "crypto/sha384.h"
16 #include "crypto/sha512.h"
17 #include "crypto/aes_wrap.h"
18 #include "crypto/crypto.h"
19 #include "ieee802_11_defs.h"
20 #include "defs.h"
21 #include "wpa_common.h"
22
23
wpa_kck_len(int akmp,size_t pmk_len)24 static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
25 {
26 switch (akmp) {
27 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
28 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
29 return 24;
30 case WPA_KEY_MGMT_FILS_SHA256:
31 case WPA_KEY_MGMT_FT_FILS_SHA256:
32 case WPA_KEY_MGMT_FILS_SHA384:
33 case WPA_KEY_MGMT_FT_FILS_SHA384:
34 return 0;
35 case WPA_KEY_MGMT_DPP:
36 return pmk_len / 2;
37 case WPA_KEY_MGMT_OWE:
38 return pmk_len / 2;
39 case WPA_KEY_MGMT_SAE_EXT_KEY:
40 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
41 return pmk_len / 2;
42 default:
43 return 16;
44 }
45 }
46
47
48 #ifdef CONFIG_IEEE80211R
wpa_kck2_len(int akmp)49 static unsigned int wpa_kck2_len(int akmp)
50 {
51 switch (akmp) {
52 case WPA_KEY_MGMT_FT_FILS_SHA256:
53 return 16;
54 case WPA_KEY_MGMT_FT_FILS_SHA384:
55 return 24;
56 default:
57 return 0;
58 }
59 }
60 #endif /* CONFIG_IEEE80211R */
61
62
wpa_kek_len(int akmp,size_t pmk_len)63 static unsigned int wpa_kek_len(int akmp, size_t pmk_len)
64 {
65 switch (akmp) {
66 case WPA_KEY_MGMT_FILS_SHA384:
67 case WPA_KEY_MGMT_FT_FILS_SHA384:
68 return 64;
69 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
70 case WPA_KEY_MGMT_FILS_SHA256:
71 case WPA_KEY_MGMT_FT_FILS_SHA256:
72 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
73 return 32;
74 case WPA_KEY_MGMT_DPP:
75 return pmk_len <= 32 ? 16 : 32;
76 case WPA_KEY_MGMT_OWE:
77 return pmk_len <= 32 ? 16 : 32;
78 case WPA_KEY_MGMT_SAE_EXT_KEY:
79 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
80 return pmk_len <= 32 ? 16 : 32;
81 default:
82 return 16;
83 }
84 }
85
86
87 #ifdef CONFIG_IEEE80211R
wpa_kek2_len(int akmp)88 static unsigned int wpa_kek2_len(int akmp)
89 {
90 switch (akmp) {
91 case WPA_KEY_MGMT_FT_FILS_SHA256:
92 return 16;
93 case WPA_KEY_MGMT_FT_FILS_SHA384:
94 return 32;
95 default:
96 return 0;
97 }
98 }
99 #endif /* CONFIG_IEEE80211R */
100
101
wpa_mic_len(int akmp,size_t pmk_len)102 unsigned int wpa_mic_len(int akmp, size_t pmk_len)
103 {
104 switch (akmp) {
105 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
106 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
107 return 24;
108 case WPA_KEY_MGMT_FILS_SHA256:
109 case WPA_KEY_MGMT_FILS_SHA384:
110 case WPA_KEY_MGMT_FT_FILS_SHA256:
111 case WPA_KEY_MGMT_FT_FILS_SHA384:
112 return 0;
113 case WPA_KEY_MGMT_DPP:
114 return pmk_len / 2;
115 case WPA_KEY_MGMT_OWE:
116 return pmk_len / 2;
117 case WPA_KEY_MGMT_SAE_EXT_KEY:
118 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
119 return pmk_len / 2;
120 default:
121 return 16;
122 }
123 }
124
125
126 /**
127 * wpa_use_akm_defined - Is AKM-defined Key Descriptor Version used
128 * @akmp: WPA_KEY_MGMT_* used in key derivation
129 * Returns: 1 if AKM-defined Key Descriptor Version is used; 0 otherwise
130 */
wpa_use_akm_defined(int akmp)131 int wpa_use_akm_defined(int akmp)
132 {
133 return akmp == WPA_KEY_MGMT_OSEN ||
134 akmp == WPA_KEY_MGMT_OWE ||
135 akmp == WPA_KEY_MGMT_DPP ||
136 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
137 wpa_key_mgmt_sae(akmp) ||
138 wpa_key_mgmt_suite_b(akmp) ||
139 wpa_key_mgmt_fils(akmp);
140 }
141
142
143 /**
144 * wpa_use_cmac - Is CMAC integrity algorithm used for EAPOL-Key MIC
145 * @akmp: WPA_KEY_MGMT_* used in key derivation
146 * Returns: 1 if CMAC is used; 0 otherwise
147 */
wpa_use_cmac(int akmp)148 int wpa_use_cmac(int akmp)
149 {
150 return akmp == WPA_KEY_MGMT_OSEN ||
151 akmp == WPA_KEY_MGMT_OWE ||
152 akmp == WPA_KEY_MGMT_DPP ||
153 wpa_key_mgmt_ft(akmp) ||
154 wpa_key_mgmt_sha256(akmp) ||
155 (wpa_key_mgmt_sae(akmp) &&
156 !wpa_key_mgmt_sae_ext_key(akmp)) ||
157 wpa_key_mgmt_suite_b(akmp);
158 }
159
160
161 /**
162 * wpa_use_aes_key_wrap - Is AES Keywrap algorithm used for EAPOL-Key Key Data
163 * @akmp: WPA_KEY_MGMT_* used in key derivation
164 * Returns: 1 if AES Keywrap is used; 0 otherwise
165 *
166 * Note: AKM 00-0F-AC:1 and 00-0F-AC:2 have special rules for selecting whether
167 * to use AES Keywrap based on the negotiated pairwise cipher. This function
168 * does not cover those special cases.
169 */
wpa_use_aes_key_wrap(int akmp)170 int wpa_use_aes_key_wrap(int akmp)
171 {
172 return akmp == WPA_KEY_MGMT_OSEN ||
173 akmp == WPA_KEY_MGMT_OWE ||
174 akmp == WPA_KEY_MGMT_DPP ||
175 wpa_key_mgmt_ft(akmp) ||
176 wpa_key_mgmt_sha256(akmp) ||
177 wpa_key_mgmt_sae(akmp) ||
178 wpa_key_mgmt_suite_b(akmp);
179 }
180
181
182 /**
183 * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
184 * @key: EAPOL-Key Key Confirmation Key (KCK)
185 * @key_len: KCK length in octets
186 * @akmp: WPA_KEY_MGMT_* used in key derivation
187 * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
188 * @buf: Pointer to the beginning of the EAPOL header (version field)
189 * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
190 * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
191 * Returns: 0 on success, -1 on failure
192 *
193 * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
194 * to be cleared (all zeroes) when calling this function.
195 *
196 * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
197 * description of the Key MIC calculation. It includes packet data from the
198 * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
199 * happened during final editing of the standard and the correct behavior is
200 * defined in the last draft (IEEE 802.11i/D10).
201 */
wpa_eapol_key_mic(const u8 * key,size_t key_len,int akmp,int ver,const u8 * buf,size_t len,u8 * mic)202 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
203 const u8 *buf, size_t len, u8 *mic)
204 {
205 u8 hash[SHA512_MAC_LEN];
206
207 if (key_len == 0) {
208 wpa_printf(MSG_DEBUG,
209 "WPA: KCK not set - cannot calculate MIC");
210 return -1;
211 }
212
213 switch (ver) {
214 #ifndef CONFIG_FIPS
215 case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
216 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-MD5");
217 return hmac_md5(key, key_len, buf, len, mic);
218 #endif /* CONFIG_FIPS */
219 case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
220 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-SHA1");
221 if (hmac_sha1(key, key_len, buf, len, hash))
222 return -1;
223 os_memcpy(mic, hash, MD5_MAC_LEN);
224 break;
225 case WPA_KEY_INFO_TYPE_AES_128_CMAC:
226 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using AES-CMAC");
227 return omac1_aes_128(key, buf, len, mic);
228 case WPA_KEY_INFO_TYPE_AKM_DEFINED:
229 switch (akmp) {
230 #ifdef CONFIG_SAE
231 case WPA_KEY_MGMT_SAE:
232 case WPA_KEY_MGMT_FT_SAE:
233 wpa_printf(MSG_DEBUG,
234 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - SAE)");
235 return omac1_aes_128(key, buf, len, mic);
236 case WPA_KEY_MGMT_SAE_EXT_KEY:
237 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
238 wpa_printf(MSG_DEBUG,
239 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - SAE-EXT-KEY)",
240 (unsigned int) key_len * 8 * 2);
241 if (key_len == 128 / 8) {
242 if (hmac_sha256(key, key_len, buf, len, hash))
243 return -1;
244 #ifdef CONFIG_SHA384
245 } else if (key_len == 192 / 8) {
246 if (hmac_sha384(key, key_len, buf, len, hash))
247 return -1;
248 #endif /* CONFIG_SHA384 */
249 #ifdef CONFIG_SHA512
250 } else if (key_len == 256 / 8) {
251 if (hmac_sha512(key, key_len, buf, len, hash))
252 return -1;
253 #endif /* CONFIG_SHA512 */
254 } else {
255 wpa_printf(MSG_INFO,
256 "SAE: Unsupported KCK length: %u",
257 (unsigned int) key_len);
258 return -1;
259 }
260 os_memcpy(mic, hash, key_len);
261 break;
262 #endif /* CONFIG_SAE */
263 #ifdef CONFIG_HS20
264 case WPA_KEY_MGMT_OSEN:
265 wpa_printf(MSG_DEBUG,
266 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - OSEN)");
267 return omac1_aes_128(key, buf, len, mic);
268 #endif /* CONFIG_HS20 */
269 #ifdef CONFIG_SUITEB
270 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
271 wpa_printf(MSG_DEBUG,
272 "WPA: EAPOL-Key MIC using HMAC-SHA256 (AKM-defined - Suite B)");
273 if (hmac_sha256(key, key_len, buf, len, hash))
274 return -1;
275 os_memcpy(mic, hash, MD5_MAC_LEN);
276 break;
277 #endif /* CONFIG_SUITEB */
278 #ifdef CONFIG_SUITEB192
279 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
280 wpa_printf(MSG_DEBUG,
281 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - Suite B 192-bit)");
282 if (hmac_sha384(key, key_len, buf, len, hash))
283 return -1;
284 os_memcpy(mic, hash, 24);
285 break;
286 #endif /* CONFIG_SUITEB192 */
287 #ifdef CONFIG_OWE
288 case WPA_KEY_MGMT_OWE:
289 wpa_printf(MSG_DEBUG,
290 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - OWE)",
291 (unsigned int) key_len * 8 * 2);
292 if (key_len == 128 / 8) {
293 if (hmac_sha256(key, key_len, buf, len, hash))
294 return -1;
295 } else if (key_len == 192 / 8) {
296 if (hmac_sha384(key, key_len, buf, len, hash))
297 return -1;
298 } else if (key_len == 256 / 8) {
299 if (hmac_sha512(key, key_len, buf, len, hash))
300 return -1;
301 } else {
302 wpa_printf(MSG_INFO,
303 "OWE: Unsupported KCK length: %u",
304 (unsigned int) key_len);
305 return -1;
306 }
307 os_memcpy(mic, hash, key_len);
308 break;
309 #endif /* CONFIG_OWE */
310 #ifdef CONFIG_DPP
311 case WPA_KEY_MGMT_DPP:
312 wpa_printf(MSG_DEBUG,
313 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - DPP)",
314 (unsigned int) key_len * 8 * 2);
315 if (key_len == 128 / 8) {
316 if (hmac_sha256(key, key_len, buf, len, hash))
317 return -1;
318 } else if (key_len == 192 / 8) {
319 if (hmac_sha384(key, key_len, buf, len, hash))
320 return -1;
321 } else if (key_len == 256 / 8) {
322 if (hmac_sha512(key, key_len, buf, len, hash))
323 return -1;
324 } else {
325 wpa_printf(MSG_INFO,
326 "DPP: Unsupported KCK length: %u",
327 (unsigned int) key_len);
328 return -1;
329 }
330 os_memcpy(mic, hash, key_len);
331 break;
332 #endif /* CONFIG_DPP */
333 #if defined(CONFIG_IEEE80211R) && defined(CONFIG_SHA384)
334 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
335 wpa_printf(MSG_DEBUG,
336 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - FT 802.1X SHA384)");
337 if (hmac_sha384(key, key_len, buf, len, hash))
338 return -1;
339 os_memcpy(mic, hash, 24);
340 break;
341 #endif /* CONFIG_IEEE80211R && CONFIG_SHA384 */
342 default:
343 wpa_printf(MSG_DEBUG,
344 "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
345 akmp);
346 return -1;
347 }
348 break;
349 default:
350 wpa_printf(MSG_DEBUG,
351 "WPA: EAPOL-Key MIC algorithm not known (ver=%d)",
352 ver);
353 return -1;
354 }
355
356 return 0;
357 }
358
359
360 /**
361 * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
362 * @pmk: Pairwise master key
363 * @pmk_len: Length of PMK
364 * @label: Label to use in derivation
365 * @addr1: AA or SA
366 * @addr2: SA or AA
367 * @nonce1: ANonce or SNonce
368 * @nonce2: SNonce or ANonce
369 * @ptk: Buffer for pairwise transient key
370 * @akmp: Negotiated AKM
371 * @cipher: Negotiated pairwise cipher
372 * @kdk_len: The length in octets that should be derived for KDK
373 * Returns: 0 on success, -1 on failure
374 *
375 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
376 * PTK = PRF-X(PMK, "Pairwise key expansion",
377 * Min(AA, SA) || Max(AA, SA) ||
378 * Min(ANonce, SNonce) || Max(ANonce, SNonce)
379 * [ || Z.x ])
380 *
381 * The optional Z.x component is used only with DPP and that part is not defined
382 * in IEEE 802.11.
383 */
wpa_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const char * label,const u8 * addr1,const u8 * addr2,const u8 * nonce1,const u8 * nonce2,struct wpa_ptk * ptk,int akmp,int cipher,const u8 * z,size_t z_len,size_t kdk_len)384 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
385 const u8 *addr1, const u8 *addr2,
386 const u8 *nonce1, const u8 *nonce2,
387 struct wpa_ptk *ptk, int akmp, int cipher,
388 const u8 *z, size_t z_len, size_t kdk_len)
389 {
390 #define MAX_Z_LEN 66 /* with NIST P-521 */
391 u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN + MAX_Z_LEN];
392 size_t data_len = 2 * ETH_ALEN + 2 * WPA_NONCE_LEN;
393 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
394 WPA_KDK_MAX_LEN];
395 size_t ptk_len;
396 #ifdef CONFIG_OWE
397 int owe_ptk_workaround = 0;
398
399 if (akmp == (WPA_KEY_MGMT_OWE | WPA_KEY_MGMT_PSK_SHA256)) {
400 owe_ptk_workaround = 1;
401 akmp = WPA_KEY_MGMT_OWE;
402 }
403 #endif /* CONFIG_OWE */
404
405 if (pmk_len == 0) {
406 wpa_printf(MSG_ERROR, "WPA: No PMK set for PTK derivation");
407 return -1;
408 }
409
410 if (z_len > MAX_Z_LEN)
411 return -1;
412
413 if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
414 os_memcpy(data, addr1, ETH_ALEN);
415 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
416 } else {
417 os_memcpy(data, addr2, ETH_ALEN);
418 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
419 }
420
421 if (os_memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
422 os_memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
423 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
424 WPA_NONCE_LEN);
425 } else {
426 os_memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
427 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
428 WPA_NONCE_LEN);
429 }
430
431 if (z && z_len) {
432 os_memcpy(data + 2 * ETH_ALEN + 2 * WPA_NONCE_LEN, z, z_len);
433 data_len += z_len;
434 }
435
436 if (kdk_len > WPA_KDK_MAX_LEN) {
437 wpa_printf(MSG_ERROR,
438 "WPA: KDK len=%zu exceeds max supported len",
439 kdk_len);
440 return -1;
441 }
442
443 ptk->kck_len = wpa_kck_len(akmp, pmk_len);
444 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
445 ptk->tk_len = wpa_cipher_key_len(cipher);
446 ptk->kdk_len = kdk_len;
447 if (ptk->tk_len == 0) {
448 wpa_printf(MSG_ERROR,
449 "WPA: Unsupported cipher (0x%x) used in PTK derivation",
450 cipher);
451 return -1;
452 }
453 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len + ptk->kdk_len;
454
455 if (wpa_key_mgmt_sha384(akmp)) {
456 #if defined(CONFIG_SUITEB192) || defined(CONFIG_FILS)
457 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
458 if (sha384_prf(pmk, pmk_len, label, data, data_len,
459 tmp, ptk_len) < 0)
460 return -1;
461 #else /* CONFIG_SUITEB192 || CONFIG_FILS */
462 return -1;
463 #endif /* CONFIG_SUITEB192 || CONFIG_FILS */
464 } else if (wpa_key_mgmt_sha256(akmp)) {
465 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
466 if (sha256_prf(pmk, pmk_len, label, data, data_len,
467 tmp, ptk_len) < 0)
468 return -1;
469 #ifdef CONFIG_OWE
470 } else if (akmp == WPA_KEY_MGMT_OWE && (pmk_len == 32 ||
471 owe_ptk_workaround)) {
472 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
473 if (sha256_prf(pmk, pmk_len, label, data, data_len,
474 tmp, ptk_len) < 0)
475 return -1;
476 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 48) {
477 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
478 if (sha384_prf(pmk, pmk_len, label, data, data_len,
479 tmp, ptk_len) < 0)
480 return -1;
481 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 64) {
482 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
483 if (sha512_prf(pmk, pmk_len, label, data, data_len,
484 tmp, ptk_len) < 0)
485 return -1;
486 } else if (akmp == WPA_KEY_MGMT_OWE) {
487 wpa_printf(MSG_INFO, "OWE: Unknown PMK length %u",
488 (unsigned int) pmk_len);
489 return -1;
490 #endif /* CONFIG_OWE */
491 #ifdef CONFIG_DPP
492 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 32) {
493 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
494 if (sha256_prf(pmk, pmk_len, label, data, data_len,
495 tmp, ptk_len) < 0)
496 return -1;
497 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 48) {
498 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
499 if (sha384_prf(pmk, pmk_len, label, data, data_len,
500 tmp, ptk_len) < 0)
501 return -1;
502 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 64) {
503 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
504 if (sha512_prf(pmk, pmk_len, label, data, data_len,
505 tmp, ptk_len) < 0)
506 return -1;
507 } else if (akmp == WPA_KEY_MGMT_DPP) {
508 wpa_printf(MSG_INFO, "DPP: Unknown PMK length %u",
509 (unsigned int) pmk_len);
510 return -1;
511 #endif /* CONFIG_DPP */
512 #ifdef CONFIG_SAE
513 } else if (wpa_key_mgmt_sae_ext_key(akmp)) {
514 if (pmk_len == 32) {
515 wpa_printf(MSG_DEBUG,
516 "SAE: PTK derivation using PRF(SHA256)");
517 if (sha256_prf(pmk, pmk_len, label, data, data_len,
518 tmp, ptk_len) < 0)
519 return -1;
520 #ifdef CONFIG_SHA384
521 } else if (pmk_len == 48) {
522 wpa_printf(MSG_DEBUG,
523 "SAE: PTK derivation using PRF(SHA384)");
524 if (sha384_prf(pmk, pmk_len, label, data, data_len,
525 tmp, ptk_len) < 0)
526 return -1;
527 #endif /* CONFIG_SHA384 */
528 #ifdef CONFIG_SHA512
529 } else if (pmk_len == 64) {
530 wpa_printf(MSG_DEBUG,
531 "SAE: PTK derivation using PRF(SHA512)");
532 if (sha512_prf(pmk, pmk_len, label, data, data_len,
533 tmp, ptk_len) < 0)
534 return -1;
535 #endif /* CONFIG_SHA512 */
536 } else {
537 wpa_printf(MSG_INFO, "SAE: Unknown PMK length %u",
538 (unsigned int) pmk_len);
539 return -1;
540 }
541 #endif /* CONFIG_SAE */
542 } else {
543 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA1)");
544 if (sha1_prf(pmk, pmk_len, label, data, data_len, tmp,
545 ptk_len) < 0)
546 return -1;
547 }
548
549 wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR,
550 MAC2STR(addr1), MAC2STR(addr2));
551 wpa_hexdump(MSG_DEBUG, "WPA: Nonce1", nonce1, WPA_NONCE_LEN);
552 wpa_hexdump(MSG_DEBUG, "WPA: Nonce2", nonce2, WPA_NONCE_LEN);
553 if (z && z_len)
554 wpa_hexdump_key(MSG_DEBUG, "WPA: Z.x", z, z_len);
555 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
556 wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
557
558 os_memcpy(ptk->kck, tmp, ptk->kck_len);
559 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
560
561 os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
562 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
563
564 os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
565 wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
566
567 if (kdk_len) {
568 os_memcpy(ptk->kdk, tmp + ptk->kck_len + ptk->kek_len +
569 ptk->tk_len, ptk->kdk_len);
570 wpa_hexdump_key(MSG_DEBUG, "WPA: KDK", ptk->kdk, ptk->kdk_len);
571 }
572
573 ptk->kek2_len = 0;
574 ptk->kck2_len = 0;
575
576 os_memset(tmp, 0, sizeof(tmp));
577 os_memset(data, 0, data_len);
578 return 0;
579 }
580
581 #ifdef CONFIG_FILS
582
fils_rmsk_to_pmk(int akmp,const u8 * rmsk,size_t rmsk_len,const u8 * snonce,const u8 * anonce,const u8 * dh_ss,size_t dh_ss_len,u8 * pmk,size_t * pmk_len)583 int fils_rmsk_to_pmk(int akmp, const u8 *rmsk, size_t rmsk_len,
584 const u8 *snonce, const u8 *anonce, const u8 *dh_ss,
585 size_t dh_ss_len, u8 *pmk, size_t *pmk_len)
586 {
587 u8 nonces[2 * FILS_NONCE_LEN];
588 const u8 *addr[2];
589 size_t len[2];
590 size_t num_elem;
591 int res;
592
593 /* PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ]) */
594 wpa_printf(MSG_DEBUG, "FILS: rMSK to PMK derivation");
595
596 if (wpa_key_mgmt_sha384(akmp))
597 *pmk_len = SHA384_MAC_LEN;
598 else if (wpa_key_mgmt_sha256(akmp))
599 *pmk_len = SHA256_MAC_LEN;
600 else
601 return -1;
602
603 wpa_hexdump_key(MSG_DEBUG, "FILS: rMSK", rmsk, rmsk_len);
604 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
605 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
606 wpa_hexdump(MSG_DEBUG, "FILS: DHss", dh_ss, dh_ss_len);
607
608 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
609 os_memcpy(&nonces[FILS_NONCE_LEN], anonce, FILS_NONCE_LEN);
610 addr[0] = rmsk;
611 len[0] = rmsk_len;
612 num_elem = 1;
613 if (dh_ss) {
614 addr[1] = dh_ss;
615 len[1] = dh_ss_len;
616 num_elem++;
617 }
618 if (wpa_key_mgmt_sha384(akmp))
619 res = hmac_sha384_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
620 addr, len, pmk);
621 else
622 res = hmac_sha256_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
623 addr, len, pmk);
624 if (res == 0)
625 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, *pmk_len);
626 else
627 *pmk_len = 0;
628 return res;
629 }
630
631
fils_pmkid_erp(int akmp,const u8 * reauth,size_t reauth_len,u8 * pmkid)632 int fils_pmkid_erp(int akmp, const u8 *reauth, size_t reauth_len,
633 u8 *pmkid)
634 {
635 const u8 *addr[1];
636 size_t len[1];
637 u8 hash[SHA384_MAC_LEN];
638 int res;
639
640 /* PMKID = Truncate-128(Hash(EAP-Initiate/Reauth)) */
641 addr[0] = reauth;
642 len[0] = reauth_len;
643 if (wpa_key_mgmt_sha384(akmp))
644 res = sha384_vector(1, addr, len, hash);
645 else if (wpa_key_mgmt_sha256(akmp))
646 res = sha256_vector(1, addr, len, hash);
647 else
648 return -1;
649 if (res)
650 return res;
651 os_memcpy(pmkid, hash, PMKID_LEN);
652 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
653 return 0;
654 }
655
656
fils_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * aa,const u8 * snonce,const u8 * anonce,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,u8 * ick,size_t * ick_len,int akmp,int cipher,u8 * fils_ft,size_t * fils_ft_len,size_t kdk_len)657 int fils_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa, const u8 *aa,
658 const u8 *snonce, const u8 *anonce, const u8 *dhss,
659 size_t dhss_len, struct wpa_ptk *ptk,
660 u8 *ick, size_t *ick_len, int akmp, int cipher,
661 u8 *fils_ft, size_t *fils_ft_len, size_t kdk_len)
662 {
663 u8 *data, *pos;
664 size_t data_len;
665 u8 tmp[FILS_ICK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
666 FILS_FT_MAX_LEN + WPA_KDK_MAX_LEN];
667 size_t key_data_len;
668 const char *label = "FILS PTK Derivation";
669 int ret = -1;
670 size_t offset;
671
672 /*
673 * FILS-Key-Data = PRF-X(PMK, "FILS PTK Derivation",
674 * SPA || AA || SNonce || ANonce [ || DHss ])
675 * ICK = L(FILS-Key-Data, 0, ICK_bits)
676 * KEK = L(FILS-Key-Data, ICK_bits, KEK_bits)
677 * TK = L(FILS-Key-Data, ICK_bits + KEK_bits, TK_bits)
678 * If doing FT initial mobility domain association:
679 * FILS-FT = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits,
680 * FILS-FT_bits)
681 * When a KDK is derived:
682 * KDK = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits + FILS-FT_bits,
683 * KDK_bits)
684 */
685 data_len = 2 * ETH_ALEN + 2 * FILS_NONCE_LEN + dhss_len;
686 data = os_malloc(data_len);
687 if (!data)
688 goto err;
689 pos = data;
690 os_memcpy(pos, spa, ETH_ALEN);
691 pos += ETH_ALEN;
692 os_memcpy(pos, aa, ETH_ALEN);
693 pos += ETH_ALEN;
694 os_memcpy(pos, snonce, FILS_NONCE_LEN);
695 pos += FILS_NONCE_LEN;
696 os_memcpy(pos, anonce, FILS_NONCE_LEN);
697 pos += FILS_NONCE_LEN;
698 if (dhss)
699 os_memcpy(pos, dhss, dhss_len);
700
701 ptk->kck_len = 0;
702 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
703 ptk->tk_len = wpa_cipher_key_len(cipher);
704 if (wpa_key_mgmt_sha384(akmp))
705 *ick_len = 48;
706 else if (wpa_key_mgmt_sha256(akmp))
707 *ick_len = 32;
708 else
709 goto err;
710 key_data_len = *ick_len + ptk->kek_len + ptk->tk_len;
711
712 if (kdk_len) {
713 if (kdk_len > WPA_KDK_MAX_LEN) {
714 wpa_printf(MSG_ERROR, "FILS: KDK len=%zu too big",
715 kdk_len);
716 goto err;
717 }
718
719 ptk->kdk_len = kdk_len;
720 key_data_len += kdk_len;
721 } else {
722 ptk->kdk_len = 0;
723 }
724
725 if (fils_ft && fils_ft_len) {
726 if (akmp == WPA_KEY_MGMT_FT_FILS_SHA256) {
727 *fils_ft_len = 32;
728 } else if (akmp == WPA_KEY_MGMT_FT_FILS_SHA384) {
729 *fils_ft_len = 48;
730 } else {
731 *fils_ft_len = 0;
732 fils_ft = NULL;
733 }
734 key_data_len += *fils_ft_len;
735 }
736
737 if (wpa_key_mgmt_sha384(akmp)) {
738 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA384)");
739 if (sha384_prf(pmk, pmk_len, label, data, data_len,
740 tmp, key_data_len) < 0)
741 goto err;
742 } else {
743 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA256)");
744 if (sha256_prf(pmk, pmk_len, label, data, data_len,
745 tmp, key_data_len) < 0)
746 goto err;
747 }
748
749 wpa_printf(MSG_DEBUG, "FILS: PTK derivation - SPA=" MACSTR
750 " AA=" MACSTR, MAC2STR(spa), MAC2STR(aa));
751 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
752 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
753 if (dhss)
754 wpa_hexdump_key(MSG_DEBUG, "FILS: DHss", dhss, dhss_len);
755 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, pmk_len);
756 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-Key-Data", tmp, key_data_len);
757
758 os_memcpy(ick, tmp, *ick_len);
759 offset = *ick_len;
760 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, *ick_len);
761
762 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
763 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK", ptk->kek, ptk->kek_len);
764 offset += ptk->kek_len;
765
766 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
767 wpa_hexdump_key(MSG_DEBUG, "FILS: TK", ptk->tk, ptk->tk_len);
768 offset += ptk->tk_len;
769
770 if (fils_ft && fils_ft_len) {
771 os_memcpy(fils_ft, tmp + offset, *fils_ft_len);
772 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-FT",
773 fils_ft, *fils_ft_len);
774 offset += *fils_ft_len;
775 }
776
777 if (ptk->kdk_len) {
778 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
779 wpa_hexdump_key(MSG_DEBUG, "FILS: KDK", ptk->kdk, ptk->kdk_len);
780 }
781
782 ptk->kek2_len = 0;
783 ptk->kck2_len = 0;
784
785 os_memset(tmp, 0, sizeof(tmp));
786 ret = 0;
787 err:
788 bin_clear_free(data, data_len);
789 return ret;
790 }
791
792
fils_key_auth_sk(const u8 * ick,size_t ick_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * g_sta,size_t g_sta_len,const u8 * g_ap,size_t g_ap_len,int akmp,u8 * key_auth_sta,u8 * key_auth_ap,size_t * key_auth_len)793 int fils_key_auth_sk(const u8 *ick, size_t ick_len, const u8 *snonce,
794 const u8 *anonce, const u8 *sta_addr, const u8 *bssid,
795 const u8 *g_sta, size_t g_sta_len,
796 const u8 *g_ap, size_t g_ap_len,
797 int akmp, u8 *key_auth_sta, u8 *key_auth_ap,
798 size_t *key_auth_len)
799 {
800 const u8 *addr[6];
801 size_t len[6];
802 size_t num_elem = 4;
803 int res;
804
805 wpa_printf(MSG_DEBUG, "FILS: Key-Auth derivation: STA-MAC=" MACSTR
806 " AP-BSSID=" MACSTR, MAC2STR(sta_addr), MAC2STR(bssid));
807 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, ick_len);
808 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
809 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
810 wpa_hexdump(MSG_DEBUG, "FILS: gSTA", g_sta, g_sta_len);
811 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
812
813 /*
814 * For (Re)Association Request frame (STA->AP):
815 * Key-Auth = HMAC-Hash(ICK, SNonce || ANonce || STA-MAC || AP-BSSID
816 * [ || gSTA || gAP ])
817 */
818 addr[0] = snonce;
819 len[0] = FILS_NONCE_LEN;
820 addr[1] = anonce;
821 len[1] = FILS_NONCE_LEN;
822 addr[2] = sta_addr;
823 len[2] = ETH_ALEN;
824 addr[3] = bssid;
825 len[3] = ETH_ALEN;
826 if (g_sta && g_sta_len && g_ap && g_ap_len) {
827 addr[4] = g_sta;
828 len[4] = g_sta_len;
829 addr[5] = g_ap;
830 len[5] = g_ap_len;
831 num_elem = 6;
832 }
833
834 if (wpa_key_mgmt_sha384(akmp)) {
835 *key_auth_len = 48;
836 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
837 key_auth_sta);
838 } else if (wpa_key_mgmt_sha256(akmp)) {
839 *key_auth_len = 32;
840 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
841 key_auth_sta);
842 } else {
843 return -1;
844 }
845 if (res < 0)
846 return res;
847
848 /*
849 * For (Re)Association Response frame (AP->STA):
850 * Key-Auth = HMAC-Hash(ICK, ANonce || SNonce || AP-BSSID || STA-MAC
851 * [ || gAP || gSTA ])
852 */
853 addr[0] = anonce;
854 addr[1] = snonce;
855 addr[2] = bssid;
856 addr[3] = sta_addr;
857 if (g_sta && g_sta_len && g_ap && g_ap_len) {
858 addr[4] = g_ap;
859 len[4] = g_ap_len;
860 addr[5] = g_sta;
861 len[5] = g_sta_len;
862 }
863
864 if (wpa_key_mgmt_sha384(akmp))
865 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
866 key_auth_ap);
867 else if (wpa_key_mgmt_sha256(akmp))
868 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
869 key_auth_ap);
870 if (res < 0)
871 return res;
872
873 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (STA)",
874 key_auth_sta, *key_auth_len);
875 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (AP)",
876 key_auth_ap, *key_auth_len);
877
878 return 0;
879 }
880
881 #endif /* CONFIG_FILS */
882
883
884 #ifdef CONFIG_IEEE80211R
wpa_ft_mic(int key_mgmt,const u8 * kck,size_t kck_len,const u8 * sta_addr,const u8 * ap_addr,u8 transaction_seqnum,const u8 * mdie,size_t mdie_len,const u8 * ftie,size_t ftie_len,const u8 * rsnie,size_t rsnie_len,const u8 * ric,size_t ric_len,const u8 * rsnxe,size_t rsnxe_len,u8 * mic)885 int wpa_ft_mic(int key_mgmt, const u8 *kck, size_t kck_len, const u8 *sta_addr,
886 const u8 *ap_addr, u8 transaction_seqnum,
887 const u8 *mdie, size_t mdie_len,
888 const u8 *ftie, size_t ftie_len,
889 const u8 *rsnie, size_t rsnie_len,
890 const u8 *ric, size_t ric_len,
891 const u8 *rsnxe, size_t rsnxe_len,
892 u8 *mic)
893 {
894 const u8 *addr[10];
895 size_t len[10];
896 size_t i, num_elem = 0;
897 u8 zero_mic[32];
898 size_t mic_len, fte_fixed_len;
899 int res;
900
901 if (kck_len == 16) {
902 mic_len = 16;
903 #ifdef CONFIG_SHA384
904 } else if (kck_len == 24) {
905 mic_len = 24;
906 #endif /* CONFIG_SHA384 */
907 #ifdef CONFIG_SHA512
908 } else if (kck_len == 32) {
909 mic_len = 32;
910 #endif /* CONFIG_SHA512 */
911 } else {
912 wpa_printf(MSG_WARNING, "FT: Unsupported KCK length %u",
913 (unsigned int) kck_len);
914 return -1;
915 }
916
917 fte_fixed_len = sizeof(struct rsn_ftie) - 16 + mic_len;
918
919 addr[num_elem] = sta_addr;
920 len[num_elem] = ETH_ALEN;
921 num_elem++;
922
923 addr[num_elem] = ap_addr;
924 len[num_elem] = ETH_ALEN;
925 num_elem++;
926
927 addr[num_elem] = &transaction_seqnum;
928 len[num_elem] = 1;
929 num_elem++;
930
931 if (rsnie) {
932 addr[num_elem] = rsnie;
933 len[num_elem] = rsnie_len;
934 num_elem++;
935 }
936 if (mdie) {
937 addr[num_elem] = mdie;
938 len[num_elem] = mdie_len;
939 num_elem++;
940 }
941 if (ftie) {
942 if (ftie_len < 2 + fte_fixed_len)
943 return -1;
944
945 /* IE hdr and mic_control */
946 addr[num_elem] = ftie;
947 len[num_elem] = 2 + 2;
948 num_elem++;
949
950 /* MIC field with all zeros */
951 os_memset(zero_mic, 0, mic_len);
952 addr[num_elem] = zero_mic;
953 len[num_elem] = mic_len;
954 num_elem++;
955
956 /* Rest of FTIE */
957 addr[num_elem] = ftie + 2 + 2 + mic_len;
958 len[num_elem] = ftie_len - (2 + 2 + mic_len);
959 num_elem++;
960 }
961 if (ric) {
962 addr[num_elem] = ric;
963 len[num_elem] = ric_len;
964 num_elem++;
965 }
966
967 if (rsnxe) {
968 addr[num_elem] = rsnxe;
969 len[num_elem] = rsnxe_len;
970 num_elem++;
971 }
972
973 for (i = 0; i < num_elem; i++)
974 wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", addr[i], len[i]);
975 res = -1;
976 #ifdef CONFIG_SHA512
977 if (kck_len == 32) {
978 u8 hash[SHA512_MAC_LEN];
979
980 if (hmac_sha512_vector(kck, kck_len, num_elem, addr, len, hash))
981 return -1;
982 os_memcpy(mic, hash, 32);
983 res = 0;
984 }
985 #endif /* CONFIG_SHA384 */
986 #ifdef CONFIG_SHA384
987 if (kck_len == 24) {
988 u8 hash[SHA384_MAC_LEN];
989
990 if (hmac_sha384_vector(kck, kck_len, num_elem, addr, len, hash))
991 return -1;
992 os_memcpy(mic, hash, 24);
993 res = 0;
994 }
995 #endif /* CONFIG_SHA384 */
996 if (kck_len == 16 && key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
997 u8 hash[SHA256_MAC_LEN];
998
999 if (hmac_sha256_vector(kck, kck_len, num_elem, addr, len, hash))
1000 return -1;
1001 os_memcpy(mic, hash, 16);
1002 res = 0;
1003 }
1004 if (kck_len == 16 && key_mgmt != WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
1005 omac1_aes_128_vector(kck, num_elem, addr, len, mic) == 0)
1006 res = 0;
1007
1008 return res;
1009 }
1010
1011
wpa_ft_parse_ftie(const u8 * ie,size_t ie_len,struct wpa_ft_ies * parse,const u8 * opt)1012 static int wpa_ft_parse_ftie(const u8 *ie, size_t ie_len,
1013 struct wpa_ft_ies *parse, const u8 *opt)
1014 {
1015 const u8 *end, *pos;
1016
1017 parse->ftie = ie;
1018 parse->ftie_len = ie_len;
1019
1020 pos = opt;
1021 end = ie + ie_len;
1022 wpa_hexdump(MSG_DEBUG, "FT: Parse FTE subelements", pos, end - pos);
1023
1024 while (end - pos >= 2) {
1025 u8 id, len;
1026
1027 id = *pos++;
1028 len = *pos++;
1029 if (len > end - pos) {
1030 wpa_printf(MSG_DEBUG, "FT: Truncated subelement");
1031 return -1;
1032 }
1033
1034 switch (id) {
1035 case FTIE_SUBELEM_R1KH_ID:
1036 if (len != FT_R1KH_ID_LEN) {
1037 wpa_printf(MSG_DEBUG,
1038 "FT: Invalid R1KH-ID length in FTIE: %d",
1039 len);
1040 return -1;
1041 }
1042 parse->r1kh_id = pos;
1043 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID",
1044 parse->r1kh_id, FT_R1KH_ID_LEN);
1045 break;
1046 case FTIE_SUBELEM_GTK:
1047 wpa_printf(MSG_DEBUG, "FT: GTK");
1048 parse->gtk = pos;
1049 parse->gtk_len = len;
1050 break;
1051 case FTIE_SUBELEM_R0KH_ID:
1052 if (len < 1 || len > FT_R0KH_ID_MAX_LEN) {
1053 wpa_printf(MSG_DEBUG,
1054 "FT: Invalid R0KH-ID length in FTIE: %d",
1055 len);
1056 return -1;
1057 }
1058 parse->r0kh_id = pos;
1059 parse->r0kh_id_len = len;
1060 wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID",
1061 parse->r0kh_id, parse->r0kh_id_len);
1062 break;
1063 case FTIE_SUBELEM_IGTK:
1064 wpa_printf(MSG_DEBUG, "FT: IGTK");
1065 parse->igtk = pos;
1066 parse->igtk_len = len;
1067 break;
1068 #ifdef CONFIG_OCV
1069 case FTIE_SUBELEM_OCI:
1070 parse->oci = pos;
1071 parse->oci_len = len;
1072 wpa_hexdump(MSG_DEBUG, "FT: OCI",
1073 parse->oci, parse->oci_len);
1074 break;
1075 #endif /* CONFIG_OCV */
1076 case FTIE_SUBELEM_BIGTK:
1077 wpa_printf(MSG_DEBUG, "FT: BIGTK");
1078 parse->bigtk = pos;
1079 parse->bigtk_len = len;
1080 break;
1081 default:
1082 wpa_printf(MSG_DEBUG, "FT: Unknown subelem id %u", id);
1083 break;
1084 }
1085
1086 pos += len;
1087 }
1088
1089 return 0;
1090 }
1091
1092
wpa_ft_parse_fte(int key_mgmt,const u8 * ie,size_t len,struct wpa_ft_ies * parse)1093 static int wpa_ft_parse_fte(int key_mgmt, const u8 *ie, size_t len,
1094 struct wpa_ft_ies *parse)
1095 {
1096 size_t mic_len;
1097 u8 mic_len_info;
1098 const u8 *pos = ie;
1099 const u8 *end = pos + len;
1100
1101 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control", pos, 2);
1102 parse->fte_rsnxe_used = pos[0] & FTE_MIC_CTRL_RSNXE_USED;
1103 mic_len_info = (pos[0] & FTE_MIC_CTRL_MIC_LEN_MASK) >>
1104 FTE_MIC_CTRL_MIC_LEN_SHIFT;
1105 parse->fte_elem_count = pos[1];
1106 pos += 2;
1107
1108 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1109 switch (mic_len_info) {
1110 case FTE_MIC_LEN_16:
1111 mic_len = 16;
1112 break;
1113 case FTE_MIC_LEN_24:
1114 mic_len = 24;
1115 break;
1116 case FTE_MIC_LEN_32:
1117 mic_len = 32;
1118 break;
1119 default:
1120 wpa_printf(MSG_DEBUG,
1121 "FT: Unknown MIC Length subfield value %u",
1122 mic_len_info);
1123 return -1;
1124 }
1125 } else {
1126 mic_len = wpa_key_mgmt_sha384(key_mgmt) ? 24 : 16;
1127 }
1128 if (mic_len > (size_t) (end - pos)) {
1129 wpa_printf(MSG_DEBUG, "FT: No room for %zu octet MIC in FTE",
1130 mic_len);
1131 return -1;
1132 }
1133 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC", pos, mic_len);
1134 parse->fte_mic = pos;
1135 parse->fte_mic_len = mic_len;
1136 pos += mic_len;
1137
1138 if (2 * WPA_NONCE_LEN > end - pos)
1139 return -1;
1140 parse->fte_anonce = pos;
1141 wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
1142 parse->fte_anonce, WPA_NONCE_LEN);
1143 pos += WPA_NONCE_LEN;
1144 parse->fte_snonce = pos;
1145 wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
1146 parse->fte_snonce, WPA_NONCE_LEN);
1147 pos += WPA_NONCE_LEN;
1148
1149 return wpa_ft_parse_ftie(ie, len, parse, pos);
1150 }
1151
1152
wpa_ft_parse_ies(const u8 * ies,size_t ies_len,struct wpa_ft_ies * parse,int key_mgmt)1153 int wpa_ft_parse_ies(const u8 *ies, size_t ies_len, struct wpa_ft_ies *parse,
1154 int key_mgmt)
1155 {
1156 const u8 *end, *pos;
1157 struct wpa_ie_data data;
1158 int ret;
1159 int prot_ie_count = 0;
1160
1161 os_memset(parse, 0, sizeof(*parse));
1162 if (ies == NULL)
1163 return 0;
1164
1165 pos = ies;
1166 end = ies + ies_len;
1167 while (end - pos >= 2) {
1168 u8 id, len;
1169
1170 id = *pos++;
1171 len = *pos++;
1172 if (len > end - pos)
1173 break;
1174
1175 switch (id) {
1176 case WLAN_EID_RSN:
1177 wpa_hexdump(MSG_DEBUG, "FT: RSNE", pos, len);
1178 parse->rsn = pos;
1179 parse->rsn_len = len;
1180 ret = wpa_parse_wpa_ie_rsn(parse->rsn - 2,
1181 parse->rsn_len + 2,
1182 &data);
1183 if (ret < 0) {
1184 wpa_printf(MSG_DEBUG, "FT: Failed to parse "
1185 "RSN IE: %d", ret);
1186 return -1;
1187 }
1188 parse->rsn_capab = data.capabilities;
1189 if (data.num_pmkid == 1 && data.pmkid)
1190 parse->rsn_pmkid = data.pmkid;
1191 parse->key_mgmt = data.key_mgmt;
1192 parse->pairwise_cipher = data.pairwise_cipher;
1193 if (!key_mgmt)
1194 key_mgmt = parse->key_mgmt;
1195 break;
1196 case WLAN_EID_RSNX:
1197 wpa_hexdump(MSG_DEBUG, "FT: RSNXE", pos, len);
1198 if (len < 1)
1199 break;
1200 parse->rsnxe = pos;
1201 parse->rsnxe_len = len;
1202 break;
1203 case WLAN_EID_MOBILITY_DOMAIN:
1204 wpa_hexdump(MSG_DEBUG, "FT: MDE", pos, len);
1205 if (len < sizeof(struct rsn_mdie))
1206 return -1;
1207 parse->mdie = pos;
1208 parse->mdie_len = len;
1209 break;
1210 case WLAN_EID_FAST_BSS_TRANSITION:
1211 wpa_hexdump(MSG_DEBUG, "FT: FTE", pos, len);
1212 /* The first two octets (MIC Control field) is in the
1213 * same offset for all cases, but the second field (MIC)
1214 * has variable length with three different values.
1215 * In particular the FT-SAE-EXT-KEY is inconvinient to
1216 * parse, so try to handle this in pieces instead of
1217 * using the struct rsn_ftie* definitions. */
1218
1219 if (len < 2)
1220 return -1;
1221 prot_ie_count = pos[1]; /* Element Count field in
1222 * MIC Control */
1223
1224 if (wpa_ft_parse_fte(key_mgmt, pos, len, parse) < 0)
1225 return -1;
1226 break;
1227 case WLAN_EID_TIMEOUT_INTERVAL:
1228 wpa_hexdump(MSG_DEBUG, "FT: Timeout Interval",
1229 pos, len);
1230 if (len != 5)
1231 break;
1232 parse->tie = pos;
1233 parse->tie_len = len;
1234 break;
1235 case WLAN_EID_RIC_DATA:
1236 if (parse->ric == NULL)
1237 parse->ric = pos - 2;
1238 break;
1239 }
1240
1241 pos += len;
1242 }
1243
1244 if (prot_ie_count == 0)
1245 return 0; /* no MIC */
1246
1247 /*
1248 * Check that the protected IE count matches with IEs included in the
1249 * frame.
1250 */
1251 if (parse->rsn)
1252 prot_ie_count--;
1253 if (parse->mdie)
1254 prot_ie_count--;
1255 if (parse->ftie)
1256 prot_ie_count--;
1257 if (parse->rsnxe)
1258 prot_ie_count--;
1259 if (prot_ie_count < 0) {
1260 wpa_printf(MSG_DEBUG, "FT: Some required IEs not included in "
1261 "the protected IE count");
1262 return -1;
1263 }
1264
1265 if (prot_ie_count == 0 && parse->ric) {
1266 wpa_printf(MSG_DEBUG, "FT: RIC IE(s) in the frame, but not "
1267 "included in protected IE count");
1268 return -1;
1269 }
1270
1271 /* Determine the end of the RIC IE(s) */
1272 if (parse->ric) {
1273 pos = parse->ric;
1274 while (end - pos >= 2 && 2 + pos[1] <= end - pos &&
1275 prot_ie_count) {
1276 prot_ie_count--;
1277 pos += 2 + pos[1];
1278 }
1279 parse->ric_len = pos - parse->ric;
1280 }
1281 if (prot_ie_count) {
1282 wpa_printf(MSG_DEBUG, "FT: %d protected IEs missing from "
1283 "frame", (int) prot_ie_count);
1284 return -1;
1285 }
1286
1287 return 0;
1288 }
1289 #endif /* CONFIG_IEEE80211R */
1290
1291
1292 #ifdef CONFIG_PASN
1293
1294 /*
1295 * pasn_use_sha384 - Should SHA384 be used or SHA256
1296 *
1297 * @akmp: Authentication and key management protocol
1298 * @cipher: The cipher suite
1299 *
1300 * According to IEEE P802.11az/D2.7, 12.12.7, the hash algorithm to use is the
1301 * hash algorithm defined for the Base AKM (see Table 9-151 (AKM suite
1302 * selectors)). When there is no Base AKM, the hash algorithm is selected based
1303 * on the pairwise cipher suite provided in the RSNE by the AP in the second
1304 * PASN frame. SHA-256 is used as the hash algorithm, except for the ciphers
1305 * 00-0F-AC:9 and 00-0F-AC:10 for which SHA-384 is used.
1306 */
pasn_use_sha384(int akmp,int cipher)1307 bool pasn_use_sha384(int akmp, int cipher)
1308 {
1309 return (akmp == WPA_KEY_MGMT_PASN && (cipher == WPA_CIPHER_CCMP_256 ||
1310 cipher == WPA_CIPHER_GCMP_256)) ||
1311 wpa_key_mgmt_sha384(akmp);
1312 }
1313
1314
1315 /**
1316 * pasn_pmk_to_ptk - Calculate PASN PTK from PMK, addresses, etc.
1317 * @pmk: Pairwise master key
1318 * @pmk_len: Length of PMK
1319 * @spa: Suppplicant address
1320 * @bssid: AP BSSID
1321 * @dhss: Is the shared secret (DHss) derived from the PASN ephemeral key
1322 * exchange encoded as an octet string
1323 * @dhss_len: The length of dhss in octets
1324 * @ptk: Buffer for pairwise transient key
1325 * @akmp: Negotiated AKM
1326 * @cipher: Negotiated pairwise cipher
1327 * @kdk_len: the length in octets that should be derived for HTLK. Can be zero.
1328 * Returns: 0 on success, -1 on failure
1329 */
pasn_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * bssid,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,int akmp,int cipher,size_t kdk_len)1330 int pasn_pmk_to_ptk(const u8 *pmk, size_t pmk_len,
1331 const u8 *spa, const u8 *bssid,
1332 const u8 *dhss, size_t dhss_len,
1333 struct wpa_ptk *ptk, int akmp, int cipher,
1334 size_t kdk_len)
1335 {
1336 u8 tmp[WPA_KCK_MAX_LEN + WPA_TK_MAX_LEN + WPA_KDK_MAX_LEN];
1337 u8 *data;
1338 size_t data_len, ptk_len;
1339 int ret = -1;
1340 const char *label = "PASN PTK Derivation";
1341
1342 if (!pmk || !pmk_len) {
1343 wpa_printf(MSG_ERROR, "PASN: No PMK set for PTK derivation");
1344 return -1;
1345 }
1346
1347 if (!dhss || !dhss_len) {
1348 wpa_printf(MSG_ERROR, "PASN: No DHss set for PTK derivation");
1349 return -1;
1350 }
1351
1352 /*
1353 * PASN-PTK = KDF(PMK, “PASN PTK Derivation”, SPA || BSSID || DHss)
1354 *
1355 * KCK = L(PASN-PTK, 0, 256)
1356 * TK = L(PASN-PTK, 256, TK_bits)
1357 * KDK = L(PASN-PTK, 256 + TK_bits, kdk_len * 8)
1358 */
1359 data_len = 2 * ETH_ALEN + dhss_len;
1360 data = os_zalloc(data_len);
1361 if (!data)
1362 return -1;
1363
1364 os_memcpy(data, spa, ETH_ALEN);
1365 os_memcpy(data + ETH_ALEN, bssid, ETH_ALEN);
1366 os_memcpy(data + 2 * ETH_ALEN, dhss, dhss_len);
1367
1368 ptk->kck_len = WPA_PASN_KCK_LEN;
1369 ptk->tk_len = wpa_cipher_key_len(cipher);
1370 ptk->kdk_len = kdk_len;
1371 ptk->kek_len = 0;
1372 ptk->kek2_len = 0;
1373 ptk->kck2_len = 0;
1374
1375 if (ptk->tk_len == 0) {
1376 wpa_printf(MSG_ERROR,
1377 "PASN: Unsupported cipher (0x%x) used in PTK derivation",
1378 cipher);
1379 goto err;
1380 }
1381
1382 ptk_len = ptk->kck_len + ptk->tk_len + ptk->kdk_len;
1383 if (ptk_len > sizeof(tmp))
1384 goto err;
1385
1386 if (pasn_use_sha384(akmp, cipher)) {
1387 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA384");
1388
1389 if (sha384_prf(pmk, pmk_len, label, data, data_len, tmp,
1390 ptk_len) < 0)
1391 goto err;
1392 } else {
1393 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA256");
1394
1395 if (sha256_prf(pmk, pmk_len, label, data, data_len, tmp,
1396 ptk_len) < 0)
1397 goto err;
1398 }
1399
1400 wpa_printf(MSG_DEBUG,
1401 "PASN: PTK derivation: SPA=" MACSTR " BSSID=" MACSTR,
1402 MAC2STR(spa), MAC2STR(bssid));
1403
1404 wpa_hexdump_key(MSG_DEBUG, "PASN: DHss", dhss, dhss_len);
1405 wpa_hexdump_key(MSG_DEBUG, "PASN: PMK", pmk, pmk_len);
1406 wpa_hexdump_key(MSG_DEBUG, "PASN: PASN-PTK", tmp, ptk_len);
1407
1408 os_memcpy(ptk->kck, tmp, WPA_PASN_KCK_LEN);
1409 wpa_hexdump_key(MSG_DEBUG, "PASN: KCK:", ptk->kck, WPA_PASN_KCK_LEN);
1410
1411 os_memcpy(ptk->tk, tmp + WPA_PASN_KCK_LEN, ptk->tk_len);
1412 wpa_hexdump_key(MSG_DEBUG, "PASN: TK:", ptk->tk, ptk->tk_len);
1413
1414 if (kdk_len) {
1415 os_memcpy(ptk->kdk, tmp + WPA_PASN_KCK_LEN + ptk->tk_len,
1416 ptk->kdk_len);
1417 wpa_hexdump_key(MSG_DEBUG, "PASN: KDK:",
1418 ptk->kdk, ptk->kdk_len);
1419 }
1420
1421 forced_memzero(tmp, sizeof(tmp));
1422 ret = 0;
1423 err:
1424 bin_clear_free(data, data_len);
1425 return ret;
1426 }
1427
1428
1429 /*
1430 * pasn_mic_len - Returns the MIC length for PASN authentication
1431 */
pasn_mic_len(int akmp,int cipher)1432 u8 pasn_mic_len(int akmp, int cipher)
1433 {
1434 if (pasn_use_sha384(akmp, cipher))
1435 return 24;
1436
1437 return 16;
1438 }
1439
1440
1441 /**
1442 * wpa_ltf_keyseed - Compute LTF keyseed from KDK
1443 * @ptk: Buffer that holds pairwise transient key
1444 * @akmp: Negotiated AKM
1445 * @cipher: Negotiated pairwise cipher
1446 * Returns: 0 on success, -1 on failure
1447 */
wpa_ltf_keyseed(struct wpa_ptk * ptk,int akmp,int cipher)1448 int wpa_ltf_keyseed(struct wpa_ptk *ptk, int akmp, int cipher)
1449 {
1450 u8 *buf;
1451 size_t buf_len;
1452 u8 hash[SHA384_MAC_LEN];
1453 const u8 *kdk = ptk->kdk;
1454 size_t kdk_len = ptk->kdk_len;
1455 const char *label = "Secure LTF key seed";
1456
1457 if (!kdk || !kdk_len) {
1458 wpa_printf(MSG_ERROR, "WPA: No KDK for LTF keyseed generation");
1459 return -1;
1460 }
1461
1462 buf = (u8 *)label;
1463 buf_len = os_strlen(label);
1464
1465 if (pasn_use_sha384(akmp, cipher)) {
1466 wpa_printf(MSG_DEBUG,
1467 "WPA: Secure LTF keyseed using HMAC-SHA384");
1468
1469 if (hmac_sha384(kdk, kdk_len, buf, buf_len, hash)) {
1470 wpa_printf(MSG_ERROR,
1471 "WPA: HMAC-SHA384 compute failed");
1472 return -1;
1473 }
1474 os_memcpy(ptk->ltf_keyseed, hash, SHA384_MAC_LEN);
1475 ptk->ltf_keyseed_len = SHA384_MAC_LEN;
1476 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1477 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1478
1479 } else {
1480 wpa_printf(MSG_DEBUG, "WPA: LTF keyseed using HMAC-SHA256");
1481
1482 if (hmac_sha256(kdk, kdk_len, buf, buf_len, hash)) {
1483 wpa_printf(MSG_ERROR,
1484 "WPA: HMAC-SHA256 compute failed");
1485 return -1;
1486 }
1487 os_memcpy(ptk->ltf_keyseed, hash, SHA256_MAC_LEN);
1488 ptk->ltf_keyseed_len = SHA256_MAC_LEN;
1489 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1490 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1491 }
1492
1493 return 0;
1494 }
1495
1496
1497 /**
1498 * pasn_mic - Calculate PASN MIC
1499 * @kck: The key confirmation key for the PASN PTKSA
1500 * @akmp: Negotiated AKM
1501 * @cipher: Negotiated pairwise cipher
1502 * @addr1: For the 2nd PASN frame supplicant address; for the 3rd frame the
1503 * BSSID
1504 * @addr2: For the 2nd PASN frame the BSSID; for the 3rd frame the supplicant
1505 * address
1506 * @data: For calculating the MIC for the 2nd PASN frame, this should hold the
1507 * Beacon frame RSNE + RSNXE. For calculating the MIC for the 3rd PASN
1508 * frame, this should hold the hash of the body of the PASN 1st frame.
1509 * @data_len: The length of data
1510 * @frame: The body of the PASN frame including the MIC element with the octets
1511 * in the MIC field of the MIC element set to 0.
1512 * @frame_len: The length of frame
1513 * @mic: Buffer to hold the MIC on success. Should be big enough to handle the
1514 * maximal MIC length
1515 * Returns: 0 on success, -1 on failure
1516 */
pasn_mic(const u8 * kck,int akmp,int cipher,const u8 * addr1,const u8 * addr2,const u8 * data,size_t data_len,const u8 * frame,size_t frame_len,u8 * mic)1517 int pasn_mic(const u8 *kck, int akmp, int cipher,
1518 const u8 *addr1, const u8 *addr2,
1519 const u8 *data, size_t data_len,
1520 const u8 *frame, size_t frame_len, u8 *mic)
1521 {
1522 u8 *buf;
1523 u8 hash[SHA384_MAC_LEN];
1524 size_t buf_len = 2 * ETH_ALEN + data_len + frame_len;
1525 int ret = -1;
1526
1527 if (!kck) {
1528 wpa_printf(MSG_ERROR, "PASN: No KCK for MIC calculation");
1529 return -1;
1530 }
1531
1532 if (!data || !data_len) {
1533 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1534 return -1;
1535 }
1536
1537 if (!frame || !frame_len) {
1538 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1539 return -1;
1540 }
1541
1542 buf = os_zalloc(buf_len);
1543 if (!buf)
1544 return -1;
1545
1546 os_memcpy(buf, addr1, ETH_ALEN);
1547 os_memcpy(buf + ETH_ALEN, addr2, ETH_ALEN);
1548
1549 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: data", data, data_len);
1550 os_memcpy(buf + 2 * ETH_ALEN, data, data_len);
1551
1552 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: frame", frame, frame_len);
1553 os_memcpy(buf + 2 * ETH_ALEN + data_len, frame, frame_len);
1554
1555 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: KCK", kck, WPA_PASN_KCK_LEN);
1556 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: buf", buf, buf_len);
1557
1558 if (pasn_use_sha384(akmp, cipher)) {
1559 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA384");
1560
1561 if (hmac_sha384(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1562 goto err;
1563
1564 os_memcpy(mic, hash, 24);
1565 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 24);
1566 } else {
1567 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA256");
1568
1569 if (hmac_sha256(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1570 goto err;
1571
1572 os_memcpy(mic, hash, 16);
1573 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 16);
1574 }
1575
1576 ret = 0;
1577 err:
1578 bin_clear_free(buf, buf_len);
1579 return ret;
1580 }
1581
1582
1583 /**
1584 * pasn_auth_frame_hash - Computes a hash of an Authentication frame body
1585 * @akmp: Negotiated AKM
1586 * @cipher: Negotiated pairwise cipher
1587 * @data: Pointer to the Authentication frame body
1588 * @len: Length of the Authentication frame body
1589 * @hash: On return would hold the computed hash. Should be big enough to handle
1590 * SHA384.
1591 * Returns: 0 on success, -1 on failure
1592 */
pasn_auth_frame_hash(int akmp,int cipher,const u8 * data,size_t len,u8 * hash)1593 int pasn_auth_frame_hash(int akmp, int cipher, const u8 *data, size_t len,
1594 u8 *hash)
1595 {
1596 if (pasn_use_sha384(akmp, cipher)) {
1597 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-384");
1598 return sha384_vector(1, &data, &len, hash);
1599 } else {
1600 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-256");
1601 return sha256_vector(1, &data, &len, hash);
1602 }
1603 }
1604
1605 #endif /* CONFIG_PASN */
1606
1607
rsn_selector_to_bitfield(const u8 * s)1608 static int rsn_selector_to_bitfield(const u8 *s)
1609 {
1610 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NONE)
1611 return WPA_CIPHER_NONE;
1612 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_TKIP)
1613 return WPA_CIPHER_TKIP;
1614 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP)
1615 return WPA_CIPHER_CCMP;
1616 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_AES_128_CMAC)
1617 return WPA_CIPHER_AES_128_CMAC;
1618 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP)
1619 return WPA_CIPHER_GCMP;
1620 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP_256)
1621 return WPA_CIPHER_CCMP_256;
1622 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP_256)
1623 return WPA_CIPHER_GCMP_256;
1624 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_128)
1625 return WPA_CIPHER_BIP_GMAC_128;
1626 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_256)
1627 return WPA_CIPHER_BIP_GMAC_256;
1628 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_CMAC_256)
1629 return WPA_CIPHER_BIP_CMAC_256;
1630 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED)
1631 return WPA_CIPHER_GTK_NOT_USED;
1632 return 0;
1633 }
1634
1635
rsn_key_mgmt_to_bitfield(const u8 * s)1636 static int rsn_key_mgmt_to_bitfield(const u8 *s)
1637 {
1638 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_UNSPEC_802_1X)
1639 return WPA_KEY_MGMT_IEEE8021X;
1640 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1641 return WPA_KEY_MGMT_PSK;
1642 #ifdef CONFIG_IEEE80211R
1643 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X)
1644 return WPA_KEY_MGMT_FT_IEEE8021X;
1645 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_PSK)
1646 return WPA_KEY_MGMT_FT_PSK;
1647 #ifdef CONFIG_SHA384
1648 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384)
1649 return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
1650 #endif /* CONFIG_SHA384 */
1651 #endif /* CONFIG_IEEE80211R */
1652 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
1653 return WPA_KEY_MGMT_IEEE8021X_SHA256;
1654 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
1655 return WPA_KEY_MGMT_PSK_SHA256;
1656 #ifdef CONFIG_SAE
1657 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE)
1658 return WPA_KEY_MGMT_SAE;
1659 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1660 return WPA_KEY_MGMT_SAE_EXT_KEY;
1661 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE)
1662 return WPA_KEY_MGMT_FT_SAE;
1663 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1664 return WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1665 #endif /* CONFIG_SAE */
1666 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B)
1667 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1668 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192)
1669 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1670 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA256)
1671 return WPA_KEY_MGMT_FILS_SHA256;
1672 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA384)
1673 return WPA_KEY_MGMT_FILS_SHA384;
1674 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA256)
1675 return WPA_KEY_MGMT_FT_FILS_SHA256;
1676 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA384)
1677 return WPA_KEY_MGMT_FT_FILS_SHA384;
1678 #ifdef CONFIG_OWE
1679 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OWE)
1680 return WPA_KEY_MGMT_OWE;
1681 #endif /* CONFIG_OWE */
1682 #ifdef CONFIG_DPP
1683 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_DPP)
1684 return WPA_KEY_MGMT_DPP;
1685 #endif /* CONFIG_DPP */
1686 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OSEN)
1687 return WPA_KEY_MGMT_OSEN;
1688 #ifdef CONFIG_PASN
1689 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PASN)
1690 return WPA_KEY_MGMT_PASN;
1691 #endif /* CONFIG_PASN */
1692 return 0;
1693 }
1694
1695
wpa_cipher_valid_group(int cipher)1696 int wpa_cipher_valid_group(int cipher)
1697 {
1698 return wpa_cipher_valid_pairwise(cipher) ||
1699 cipher == WPA_CIPHER_GTK_NOT_USED;
1700 }
1701
1702
wpa_cipher_valid_mgmt_group(int cipher)1703 int wpa_cipher_valid_mgmt_group(int cipher)
1704 {
1705 return cipher == WPA_CIPHER_GTK_NOT_USED ||
1706 cipher == WPA_CIPHER_AES_128_CMAC ||
1707 cipher == WPA_CIPHER_BIP_GMAC_128 ||
1708 cipher == WPA_CIPHER_BIP_GMAC_256 ||
1709 cipher == WPA_CIPHER_BIP_CMAC_256;
1710 }
1711
1712
1713 /**
1714 * wpa_parse_wpa_ie_rsn - Parse RSN IE
1715 * @rsn_ie: Buffer containing RSN IE
1716 * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
1717 * @data: Pointer to structure that will be filled in with parsed data
1718 * Returns: 0 on success, <0 on failure
1719 */
wpa_parse_wpa_ie_rsn(const u8 * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)1720 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
1721 struct wpa_ie_data *data)
1722 {
1723 const u8 *pos;
1724 int left;
1725 int i, count;
1726
1727 os_memset(data, 0, sizeof(*data));
1728 data->proto = WPA_PROTO_RSN;
1729 data->pairwise_cipher = WPA_CIPHER_CCMP;
1730 data->group_cipher = WPA_CIPHER_CCMP;
1731 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1732 data->capabilities = 0;
1733 data->pmkid = NULL;
1734 data->num_pmkid = 0;
1735 data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1736
1737 if (rsn_ie_len == 0) {
1738 /* No RSN IE - fail silently */
1739 return -1;
1740 }
1741
1742 if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
1743 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1744 __func__, (unsigned long) rsn_ie_len);
1745 return -1;
1746 }
1747
1748 if (rsn_ie_len >= 6 && rsn_ie[1] >= 4 &&
1749 rsn_ie[1] == rsn_ie_len - 2 &&
1750 WPA_GET_BE32(&rsn_ie[2]) == OSEN_IE_VENDOR_TYPE) {
1751 pos = rsn_ie + 6;
1752 left = rsn_ie_len - 6;
1753
1754 data->group_cipher = WPA_CIPHER_GTK_NOT_USED;
1755 data->has_group = 1;
1756 data->key_mgmt = WPA_KEY_MGMT_OSEN;
1757 data->proto = WPA_PROTO_OSEN;
1758 } else {
1759 const struct rsn_ie_hdr *hdr;
1760
1761 hdr = (const struct rsn_ie_hdr *) rsn_ie;
1762
1763 if (hdr->elem_id != WLAN_EID_RSN ||
1764 hdr->len != rsn_ie_len - 2 ||
1765 WPA_GET_LE16(hdr->version) != RSN_VERSION) {
1766 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1767 __func__);
1768 return -2;
1769 }
1770
1771 pos = (const u8 *) (hdr + 1);
1772 left = rsn_ie_len - sizeof(*hdr);
1773 }
1774
1775 if (left >= RSN_SELECTOR_LEN) {
1776 data->group_cipher = rsn_selector_to_bitfield(pos);
1777 data->has_group = 1;
1778 if (!wpa_cipher_valid_group(data->group_cipher)) {
1779 wpa_printf(MSG_DEBUG,
1780 "%s: invalid group cipher 0x%x (%08x)",
1781 __func__, data->group_cipher,
1782 WPA_GET_BE32(pos));
1783 #ifdef CONFIG_NO_TKIP
1784 if (RSN_SELECTOR_GET(pos) == RSN_CIPHER_SUITE_TKIP) {
1785 wpa_printf(MSG_DEBUG,
1786 "%s: TKIP as group cipher not supported in CONFIG_NO_TKIP=y build",
1787 __func__);
1788 }
1789 #endif /* CONFIG_NO_TKIP */
1790 return -1;
1791 }
1792 pos += RSN_SELECTOR_LEN;
1793 left -= RSN_SELECTOR_LEN;
1794 } else if (left > 0) {
1795 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1796 __func__, left);
1797 return -3;
1798 }
1799
1800 if (left >= 2) {
1801 data->pairwise_cipher = 0;
1802 count = WPA_GET_LE16(pos);
1803 pos += 2;
1804 left -= 2;
1805 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1806 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1807 "count %u left %u", __func__, count, left);
1808 return -4;
1809 }
1810 if (count)
1811 data->has_pairwise = 1;
1812 for (i = 0; i < count; i++) {
1813 data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
1814 pos += RSN_SELECTOR_LEN;
1815 left -= RSN_SELECTOR_LEN;
1816 }
1817 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
1818 wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
1819 "pairwise cipher", __func__);
1820 return -1;
1821 }
1822 } else if (left == 1) {
1823 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1824 __func__);
1825 return -5;
1826 }
1827
1828 if (left >= 2) {
1829 data->key_mgmt = 0;
1830 count = WPA_GET_LE16(pos);
1831 pos += 2;
1832 left -= 2;
1833 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1834 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1835 "count %u left %u", __func__, count, left);
1836 return -6;
1837 }
1838 for (i = 0; i < count; i++) {
1839 data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
1840 pos += RSN_SELECTOR_LEN;
1841 left -= RSN_SELECTOR_LEN;
1842 }
1843 } else if (left == 1) {
1844 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
1845 __func__);
1846 return -7;
1847 }
1848
1849 if (left >= 2) {
1850 data->capabilities = WPA_GET_LE16(pos);
1851 pos += 2;
1852 left -= 2;
1853 }
1854
1855 if (left >= 2) {
1856 u16 num_pmkid = WPA_GET_LE16(pos);
1857 pos += 2;
1858 left -= 2;
1859 if (num_pmkid > (unsigned int) left / PMKID_LEN) {
1860 wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
1861 "(num_pmkid=%u left=%d)",
1862 __func__, num_pmkid, left);
1863 data->num_pmkid = 0;
1864 return -9;
1865 } else {
1866 data->num_pmkid = num_pmkid;
1867 data->pmkid = pos;
1868 pos += data->num_pmkid * PMKID_LEN;
1869 left -= data->num_pmkid * PMKID_LEN;
1870 }
1871 }
1872
1873 if (left >= 4) {
1874 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
1875 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
1876 wpa_printf(MSG_DEBUG,
1877 "%s: Unsupported management group cipher 0x%x (%08x)",
1878 __func__, data->mgmt_group_cipher,
1879 WPA_GET_BE32(pos));
1880 return -10;
1881 }
1882 pos += RSN_SELECTOR_LEN;
1883 left -= RSN_SELECTOR_LEN;
1884 }
1885
1886 if (left > 0) {
1887 wpa_hexdump(MSG_DEBUG,
1888 "wpa_parse_wpa_ie_rsn: ignore trailing bytes",
1889 pos, left);
1890 }
1891
1892 return 0;
1893 }
1894
1895
wpa_selector_to_bitfield(const u8 * s)1896 static int wpa_selector_to_bitfield(const u8 *s)
1897 {
1898 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
1899 return WPA_CIPHER_NONE;
1900 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
1901 return WPA_CIPHER_TKIP;
1902 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
1903 return WPA_CIPHER_CCMP;
1904 return 0;
1905 }
1906
1907
wpa_key_mgmt_to_bitfield(const u8 * s)1908 static int wpa_key_mgmt_to_bitfield(const u8 *s)
1909 {
1910 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
1911 return WPA_KEY_MGMT_IEEE8021X;
1912 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1913 return WPA_KEY_MGMT_PSK;
1914 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
1915 return WPA_KEY_MGMT_WPA_NONE;
1916 return 0;
1917 }
1918
1919
wpa_parse_wpa_ie_wpa(const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)1920 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
1921 struct wpa_ie_data *data)
1922 {
1923 const struct wpa_ie_hdr *hdr;
1924 const u8 *pos;
1925 int left;
1926 int i, count;
1927
1928 os_memset(data, 0, sizeof(*data));
1929 data->proto = WPA_PROTO_WPA;
1930 data->pairwise_cipher = WPA_CIPHER_TKIP;
1931 data->group_cipher = WPA_CIPHER_TKIP;
1932 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1933 data->capabilities = 0;
1934 data->pmkid = NULL;
1935 data->num_pmkid = 0;
1936 data->mgmt_group_cipher = 0;
1937
1938 if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
1939 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1940 __func__, (unsigned long) wpa_ie_len);
1941 return -1;
1942 }
1943
1944 hdr = (const struct wpa_ie_hdr *) wpa_ie;
1945
1946 if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
1947 hdr->len != wpa_ie_len - 2 ||
1948 RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
1949 WPA_GET_LE16(hdr->version) != WPA_VERSION) {
1950 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1951 __func__);
1952 return -2;
1953 }
1954
1955 pos = (const u8 *) (hdr + 1);
1956 left = wpa_ie_len - sizeof(*hdr);
1957
1958 if (left >= WPA_SELECTOR_LEN) {
1959 data->group_cipher = wpa_selector_to_bitfield(pos);
1960 pos += WPA_SELECTOR_LEN;
1961 left -= WPA_SELECTOR_LEN;
1962 } else if (left > 0) {
1963 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1964 __func__, left);
1965 return -3;
1966 }
1967
1968 if (left >= 2) {
1969 data->pairwise_cipher = 0;
1970 count = WPA_GET_LE16(pos);
1971 pos += 2;
1972 left -= 2;
1973 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
1974 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1975 "count %u left %u", __func__, count, left);
1976 return -4;
1977 }
1978 for (i = 0; i < count; i++) {
1979 data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
1980 pos += WPA_SELECTOR_LEN;
1981 left -= WPA_SELECTOR_LEN;
1982 }
1983 } else if (left == 1) {
1984 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1985 __func__);
1986 return -5;
1987 }
1988
1989 if (left >= 2) {
1990 data->key_mgmt = 0;
1991 count = WPA_GET_LE16(pos);
1992 pos += 2;
1993 left -= 2;
1994 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
1995 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1996 "count %u left %u", __func__, count, left);
1997 return -6;
1998 }
1999 for (i = 0; i < count; i++) {
2000 data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
2001 pos += WPA_SELECTOR_LEN;
2002 left -= WPA_SELECTOR_LEN;
2003 }
2004 } else if (left == 1) {
2005 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
2006 __func__);
2007 return -7;
2008 }
2009
2010 if (left >= 2) {
2011 data->capabilities = WPA_GET_LE16(pos);
2012 pos += 2;
2013 left -= 2;
2014 }
2015
2016 if (left > 0) {
2017 wpa_hexdump(MSG_DEBUG,
2018 "wpa_parse_wpa_ie_wpa: ignore trailing bytes",
2019 pos, left);
2020 }
2021
2022 return 0;
2023 }
2024
2025
wpa_default_rsn_cipher(int freq)2026 int wpa_default_rsn_cipher(int freq)
2027 {
2028 if (freq > 56160)
2029 return WPA_CIPHER_GCMP; /* DMG */
2030
2031 return WPA_CIPHER_CCMP;
2032 }
2033
2034
2035 #ifdef CONFIG_IEEE80211R
2036
2037 /**
2038 * wpa_derive_pmk_r0 - Derive PMK-R0 and PMKR0Name
2039 *
2040 * IEEE Std 802.11r-2008 - 8.5.1.5.3
2041 */
wpa_derive_pmk_r0(const u8 * xxkey,size_t xxkey_len,const u8 * ssid,size_t ssid_len,const u8 * mdid,const u8 * r0kh_id,size_t r0kh_id_len,const u8 * s0kh_id,u8 * pmk_r0,u8 * pmk_r0_name,int key_mgmt)2042 int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
2043 const u8 *ssid, size_t ssid_len,
2044 const u8 *mdid, const u8 *r0kh_id, size_t r0kh_id_len,
2045 const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
2046 int key_mgmt)
2047 {
2048 u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
2049 FT_R0KH_ID_MAX_LEN + ETH_ALEN];
2050 u8 *pos, r0_key_data[64 + 16], hash[64];
2051 const u8 *addr[2];
2052 size_t len[2];
2053 size_t q, r0_key_data_len;
2054 int res;
2055
2056 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2057 (xxkey_len == SHA256_MAC_LEN || xxkey_len == SHA384_MAC_LEN ||
2058 xxkey_len == SHA512_MAC_LEN))
2059 q = xxkey_len;
2060 else if (wpa_key_mgmt_sha384(key_mgmt))
2061 q = SHA384_MAC_LEN;
2062 else
2063 q = SHA256_MAC_LEN;
2064 r0_key_data_len = q + 16;
2065
2066 /*
2067 * R0-Key-Data = KDF-Hash-Length(XXKey, "FT-R0",
2068 * SSIDlength || SSID || MDID || R0KHlength ||
2069 * R0KH-ID || S0KH-ID)
2070 * XXKey is either the second 256 bits of MSK or PSK; or the first
2071 * 384 bits of MSK for FT-EAP-SHA384; or PMK from SAE.
2072 * PMK-R0 = L(R0-Key-Data, 0, Q)
2073 * PMK-R0Name-Salt = L(R0-Key-Data, Q, 128)
2074 * Q = 384 for FT-EAP-SHA384; the length of the digest generated by H()
2075 * for FT-SAE-EXT-KEY; or otherwise, 256
2076 */
2077 if (ssid_len > SSID_MAX_LEN || r0kh_id_len > FT_R0KH_ID_MAX_LEN)
2078 return -1;
2079 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R0 using KDF-SHA%zu", q * 8);
2080 wpa_hexdump_key(MSG_DEBUG, "FT: XXKey", xxkey, xxkey_len);
2081 wpa_hexdump_ascii(MSG_DEBUG, "FT: SSID", ssid, ssid_len);
2082 wpa_hexdump(MSG_DEBUG, "FT: MDID", mdid, MOBILITY_DOMAIN_ID_LEN);
2083 wpa_hexdump_ascii(MSG_DEBUG, "FT: R0KH-ID", r0kh_id, r0kh_id_len);
2084 wpa_printf(MSG_DEBUG, "FT: S0KH-ID: " MACSTR, MAC2STR(s0kh_id));
2085 pos = buf;
2086 *pos++ = ssid_len;
2087 os_memcpy(pos, ssid, ssid_len);
2088 pos += ssid_len;
2089 os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);
2090 pos += MOBILITY_DOMAIN_ID_LEN;
2091 *pos++ = r0kh_id_len;
2092 os_memcpy(pos, r0kh_id, r0kh_id_len);
2093 pos += r0kh_id_len;
2094 os_memcpy(pos, s0kh_id, ETH_ALEN);
2095 pos += ETH_ALEN;
2096
2097 res = -1;
2098 #ifdef CONFIG_SHA512
2099 if (q == SHA512_MAC_LEN) {
2100 if (xxkey_len != SHA512_MAC_LEN) {
2101 wpa_printf(MSG_ERROR,
2102 "FT: Unexpected XXKey length %d (expected %d)",
2103 (int) xxkey_len, SHA512_MAC_LEN);
2104 return -1;
2105 }
2106 res = sha512_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2107 r0_key_data, r0_key_data_len);
2108 }
2109 #endif /* CONFIG_SHA512 */
2110 #ifdef CONFIG_SHA384
2111 if (q == SHA384_MAC_LEN) {
2112 if (xxkey_len != SHA384_MAC_LEN) {
2113 wpa_printf(MSG_ERROR,
2114 "FT: Unexpected XXKey length %d (expected %d)",
2115 (int) xxkey_len, SHA384_MAC_LEN);
2116 return -1;
2117 }
2118 res = sha384_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2119 r0_key_data, r0_key_data_len);
2120 }
2121 #endif /* CONFIG_SHA384 */
2122 if (q == SHA256_MAC_LEN) {
2123 if (xxkey_len != PMK_LEN) {
2124 wpa_printf(MSG_ERROR,
2125 "FT: Unexpected XXKey length %d (expected %d)",
2126 (int) xxkey_len, PMK_LEN);
2127 return -1;
2128 }
2129 res = sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2130 r0_key_data, r0_key_data_len);
2131 }
2132 if (res < 0)
2133 return res;
2134 os_memcpy(pmk_r0, r0_key_data, q);
2135 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, q);
2136 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
2137
2138 /*
2139 * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
2140 */
2141 addr[0] = (const u8 *) "FT-R0N";
2142 len[0] = 6;
2143 addr[1] = &r0_key_data[q];
2144 len[1] = 16;
2145
2146 res = -1;
2147 #ifdef CONFIG_SHA512
2148 if (q == SHA512_MAC_LEN)
2149 res = sha512_vector(2, addr, len, hash);
2150 #endif /* CONFIG_SHA512 */
2151 #ifdef CONFIG_SHA384
2152 if (q == SHA384_MAC_LEN)
2153 res = sha384_vector(2, addr, len, hash);
2154 #endif /* CONFIG_SHA384 */
2155 if (q == SHA256_MAC_LEN)
2156 res = sha256_vector(2, addr, len, hash);
2157 if (res < 0) {
2158 wpa_printf(MSG_DEBUG,
2159 "FT: Failed to derive PMKR0Name (PMK-R0 len %zu)",
2160 q);
2161 return res;
2162 }
2163 os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
2164 wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN);
2165 forced_memzero(r0_key_data, sizeof(r0_key_data));
2166 return 0;
2167 }
2168
2169
2170 /**
2171 * wpa_derive_pmk_r1_name - Derive PMKR1Name
2172 *
2173 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2174 */
wpa_derive_pmk_r1_name(const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1_name,size_t pmk_r1_len)2175 int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
2176 const u8 *s1kh_id, u8 *pmk_r1_name,
2177 size_t pmk_r1_len)
2178 {
2179 u8 hash[64];
2180 const u8 *addr[4];
2181 size_t len[4];
2182 int res;
2183 const char *title;
2184
2185 /*
2186 * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
2187 * R1KH-ID || S1KH-ID))
2188 */
2189 addr[0] = (const u8 *) "FT-R1N";
2190 len[0] = 6;
2191 addr[1] = pmk_r0_name;
2192 len[1] = WPA_PMK_NAME_LEN;
2193 addr[2] = r1kh_id;
2194 len[2] = FT_R1KH_ID_LEN;
2195 addr[3] = s1kh_id;
2196 len[3] = ETH_ALEN;
2197
2198 res = -1;
2199 #ifdef CONFIG_SHA512
2200 if (pmk_r1_len == SHA512_MAC_LEN) {
2201 title = "FT: PMKR1Name (using SHA512)";
2202 res = sha512_vector(4, addr, len, hash);
2203 }
2204 #endif /* CONFIG_SHA512 */
2205 #ifdef CONFIG_SHA384
2206 if (pmk_r1_len == SHA384_MAC_LEN) {
2207 title = "FT: PMKR1Name (using SHA384)";
2208 res = sha384_vector(4, addr, len, hash);
2209 }
2210 #endif /* CONFIG_SHA384 */
2211 if (pmk_r1_len == SHA256_MAC_LEN) {
2212 title = "FT: PMKR1Name (using SHA256)";
2213 res = sha256_vector(4, addr, len, hash);
2214 }
2215 if (res < 0) {
2216 wpa_printf(MSG_DEBUG,
2217 "FT: Failed to derive PMKR1Name (PMK-R1 len %zu)",
2218 pmk_r1_len);
2219 return res;
2220 }
2221 os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
2222 wpa_hexdump(MSG_DEBUG, title, pmk_r1_name, WPA_PMK_NAME_LEN);
2223 return 0;
2224 }
2225
2226
2227 /**
2228 * wpa_derive_pmk_r1 - Derive PMK-R1 and PMKR1Name from PMK-R0
2229 *
2230 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2231 */
wpa_derive_pmk_r1(const u8 * pmk_r0,size_t pmk_r0_len,const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1,u8 * pmk_r1_name)2232 int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
2233 const u8 *pmk_r0_name,
2234 const u8 *r1kh_id, const u8 *s1kh_id,
2235 u8 *pmk_r1, u8 *pmk_r1_name)
2236 {
2237 u8 buf[FT_R1KH_ID_LEN + ETH_ALEN];
2238 u8 *pos;
2239 int res;
2240
2241 /* PMK-R1 = KDF-Hash(PMK-R0, "FT-R1", R1KH-ID || S1KH-ID) */
2242 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R1 using KDF-SHA%zu",
2243 pmk_r0_len * 8);
2244 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len);
2245 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", r1kh_id, FT_R1KH_ID_LEN);
2246 wpa_printf(MSG_DEBUG, "FT: S1KH-ID: " MACSTR, MAC2STR(s1kh_id));
2247 pos = buf;
2248 os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);
2249 pos += FT_R1KH_ID_LEN;
2250 os_memcpy(pos, s1kh_id, ETH_ALEN);
2251 pos += ETH_ALEN;
2252
2253 res = -1;
2254 #ifdef CONFIG_SHA512
2255 if (pmk_r0_len == SHA512_MAC_LEN)
2256 res = sha512_prf(pmk_r0, pmk_r0_len, "FT-R1",
2257 buf, pos - buf, pmk_r1, pmk_r0_len);
2258 #endif /* CONFIG_SHA512 */
2259 #ifdef CONFIG_SHA384
2260 if (pmk_r0_len == SHA384_MAC_LEN)
2261 res = sha384_prf(pmk_r0, pmk_r0_len, "FT-R1",
2262 buf, pos - buf, pmk_r1, pmk_r0_len);
2263 #endif /* CONFIG_SHA384 */
2264 if (pmk_r0_len == SHA256_MAC_LEN)
2265 res = sha256_prf(pmk_r0, pmk_r0_len, "FT-R1",
2266 buf, pos - buf, pmk_r1, pmk_r0_len);
2267 if (res < 0) {
2268 wpa_printf(MSG_ERROR, "FT: Failed to derive PMK-R1");
2269 return res;
2270 }
2271 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
2272
2273 return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
2274 pmk_r1_name, pmk_r0_len);
2275 }
2276
2277
2278 /**
2279 * wpa_pmk_r1_to_ptk - Derive PTK and PTKName from PMK-R1
2280 *
2281 * IEEE Std 802.11r-2008 - 8.5.1.5.5
2282 */
wpa_pmk_r1_to_ptk(const u8 * pmk_r1,size_t pmk_r1_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * pmk_r1_name,struct wpa_ptk * ptk,u8 * ptk_name,int akmp,int cipher,size_t kdk_len)2283 int wpa_pmk_r1_to_ptk(const u8 *pmk_r1, size_t pmk_r1_len,
2284 const u8 *snonce, const u8 *anonce,
2285 const u8 *sta_addr, const u8 *bssid,
2286 const u8 *pmk_r1_name,
2287 struct wpa_ptk *ptk, u8 *ptk_name, int akmp, int cipher,
2288 size_t kdk_len)
2289 {
2290 u8 buf[2 * WPA_NONCE_LEN + 2 * ETH_ALEN];
2291 u8 *pos, hash[32];
2292 const u8 *addr[6];
2293 size_t len[6];
2294 u8 tmp[2 * WPA_KCK_MAX_LEN + 2 * WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
2295 WPA_KDK_MAX_LEN];
2296 size_t ptk_len, offset;
2297 size_t key_len;
2298 int res;
2299
2300 if (kdk_len > WPA_KDK_MAX_LEN) {
2301 wpa_printf(MSG_ERROR,
2302 "FT: KDK len=%zu exceeds max supported len",
2303 kdk_len);
2304 return -1;
2305 }
2306
2307 if (akmp == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2308 (pmk_r1_len == SHA256_MAC_LEN || pmk_r1_len == SHA384_MAC_LEN ||
2309 pmk_r1_len == SHA512_MAC_LEN))
2310 key_len = pmk_r1_len;
2311 else if (wpa_key_mgmt_sha384(akmp))
2312 key_len = SHA384_MAC_LEN;
2313 else
2314 key_len = SHA256_MAC_LEN;
2315
2316 /*
2317 * PTK = KDF-PTKLen(PMK-R1, "FT-PTK", SNonce || ANonce ||
2318 * BSSID || STA-ADDR)
2319 */
2320 wpa_printf(MSG_DEBUG, "FT: Derive PTK using KDF-SHA%zu", key_len * 8);
2321 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len);
2322 wpa_hexdump(MSG_DEBUG, "FT: SNonce", snonce, WPA_NONCE_LEN);
2323 wpa_hexdump(MSG_DEBUG, "FT: ANonce", anonce, WPA_NONCE_LEN);
2324 wpa_printf(MSG_DEBUG, "FT: BSSID=" MACSTR " STA-ADDR=" MACSTR,
2325 MAC2STR(bssid), MAC2STR(sta_addr));
2326 pos = buf;
2327 os_memcpy(pos, snonce, WPA_NONCE_LEN);
2328 pos += WPA_NONCE_LEN;
2329 os_memcpy(pos, anonce, WPA_NONCE_LEN);
2330 pos += WPA_NONCE_LEN;
2331 os_memcpy(pos, bssid, ETH_ALEN);
2332 pos += ETH_ALEN;
2333 os_memcpy(pos, sta_addr, ETH_ALEN);
2334 pos += ETH_ALEN;
2335
2336 ptk->kck_len = wpa_kck_len(akmp, key_len);
2337 ptk->kck2_len = wpa_kck2_len(akmp);
2338 ptk->kek_len = wpa_kek_len(akmp, key_len);
2339 ptk->kek2_len = wpa_kek2_len(akmp);
2340 ptk->tk_len = wpa_cipher_key_len(cipher);
2341 ptk->kdk_len = kdk_len;
2342 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len +
2343 ptk->kck2_len + ptk->kek2_len + ptk->kdk_len;
2344
2345 res = -1;
2346 #ifdef CONFIG_SHA512
2347 if (key_len == SHA512_MAC_LEN) {
2348 if (pmk_r1_len != SHA512_MAC_LEN) {
2349 wpa_printf(MSG_ERROR,
2350 "FT: Unexpected PMK-R1 length %d (expected %d)",
2351 (int) pmk_r1_len, SHA512_MAC_LEN);
2352 return -1;
2353 }
2354 res = sha512_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2355 buf, pos - buf, tmp, ptk_len);
2356 }
2357 #endif /* CONFIG_SHA512 */
2358 #ifdef CONFIG_SHA384
2359 if (key_len == SHA384_MAC_LEN) {
2360 if (pmk_r1_len != SHA384_MAC_LEN) {
2361 wpa_printf(MSG_ERROR,
2362 "FT: Unexpected PMK-R1 length %d (expected %d)",
2363 (int) pmk_r1_len, SHA384_MAC_LEN);
2364 return -1;
2365 }
2366 res = sha384_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2367 buf, pos - buf, tmp, ptk_len);
2368 }
2369 #endif /* CONFIG_SHA384 */
2370 if (key_len == SHA256_MAC_LEN) {
2371 if (pmk_r1_len != PMK_LEN) {
2372 wpa_printf(MSG_ERROR,
2373 "FT: Unexpected PMK-R1 length %d (expected %d)",
2374 (int) pmk_r1_len, PMK_LEN);
2375 return -1;
2376 }
2377 res = sha256_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2378 buf, pos - buf, tmp, ptk_len);
2379 }
2380 if (res < 0)
2381 return -1;
2382 wpa_hexdump_key(MSG_DEBUG, "FT: PTK", tmp, ptk_len);
2383
2384 /*
2385 * PTKName = Truncate-128(SHA-256(PMKR1Name || "FT-PTKN" || SNonce ||
2386 * ANonce || BSSID || STA-ADDR))
2387 */
2388 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN);
2389 addr[0] = pmk_r1_name;
2390 len[0] = WPA_PMK_NAME_LEN;
2391 addr[1] = (const u8 *) "FT-PTKN";
2392 len[1] = 7;
2393 addr[2] = snonce;
2394 len[2] = WPA_NONCE_LEN;
2395 addr[3] = anonce;
2396 len[3] = WPA_NONCE_LEN;
2397 addr[4] = bssid;
2398 len[4] = ETH_ALEN;
2399 addr[5] = sta_addr;
2400 len[5] = ETH_ALEN;
2401
2402 if (sha256_vector(6, addr, len, hash) < 0)
2403 return -1;
2404 os_memcpy(ptk_name, hash, WPA_PMK_NAME_LEN);
2405
2406 os_memcpy(ptk->kck, tmp, ptk->kck_len);
2407 offset = ptk->kck_len;
2408 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
2409 offset += ptk->kek_len;
2410 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
2411 offset += ptk->tk_len;
2412 os_memcpy(ptk->kck2, tmp + offset, ptk->kck2_len);
2413 offset += ptk->kck2_len;
2414 os_memcpy(ptk->kek2, tmp + offset, ptk->kek2_len);
2415 offset += ptk->kek2_len;
2416 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
2417
2418 wpa_hexdump_key(MSG_DEBUG, "FT: KCK", ptk->kck, ptk->kck_len);
2419 wpa_hexdump_key(MSG_DEBUG, "FT: KEK", ptk->kek, ptk->kek_len);
2420 if (ptk->kck2_len)
2421 wpa_hexdump_key(MSG_DEBUG, "FT: KCK2",
2422 ptk->kck2, ptk->kck2_len);
2423 if (ptk->kek2_len)
2424 wpa_hexdump_key(MSG_DEBUG, "FT: KEK2",
2425 ptk->kek2, ptk->kek2_len);
2426 if (ptk->kdk_len)
2427 wpa_hexdump_key(MSG_DEBUG, "FT: KDK", ptk->kdk, ptk->kdk_len);
2428
2429 wpa_hexdump_key(MSG_DEBUG, "FT: TK", ptk->tk, ptk->tk_len);
2430 wpa_hexdump(MSG_DEBUG, "FT: PTKName", ptk_name, WPA_PMK_NAME_LEN);
2431
2432 forced_memzero(tmp, sizeof(tmp));
2433
2434 return 0;
2435 }
2436
2437 #endif /* CONFIG_IEEE80211R */
2438
2439
2440 /**
2441 * rsn_pmkid - Calculate PMK identifier
2442 * @pmk: Pairwise master key
2443 * @pmk_len: Length of pmk in bytes
2444 * @aa: Authenticator address
2445 * @spa: Supplicant address
2446 * @pmkid: Buffer for PMKID
2447 * @akmp: Negotiated key management protocol
2448 *
2449 * IEEE Std 802.11-2016 - 12.7.1.3 Pairwise key hierarchy
2450 * AKM: 00-0F-AC:3, 00-0F-AC:5, 00-0F-AC:6, 00-0F-AC:14, 00-0F-AC:16
2451 * PMKID = Truncate-128(HMAC-SHA-256(PMK, "PMK Name" || AA || SPA))
2452 * AKM: 00-0F-AC:11
2453 * See rsn_pmkid_suite_b()
2454 * AKM: 00-0F-AC:12
2455 * See rsn_pmkid_suite_b_192()
2456 * AKM: 00-0F-AC:13, 00-0F-AC:15, 00-0F-AC:17
2457 * PMKID = Truncate-128(HMAC-SHA-384(PMK, "PMK Name" || AA || SPA))
2458 * Otherwise:
2459 * PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name" || AA || SPA))
2460 */
rsn_pmkid(const u8 * pmk,size_t pmk_len,const u8 * aa,const u8 * spa,u8 * pmkid,int akmp)2461 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
2462 u8 *pmkid, int akmp)
2463 {
2464 char *title = "PMK Name";
2465 const u8 *addr[3];
2466 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2467 unsigned char hash[SHA384_MAC_LEN];
2468
2469 addr[0] = (u8 *) title;
2470 addr[1] = aa;
2471 addr[2] = spa;
2472
2473 if (0) {
2474 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
2475 } else if (wpa_key_mgmt_sha384(akmp)) {
2476 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-384");
2477 hmac_sha384_vector(pmk, pmk_len, 3, addr, len, hash);
2478 #endif /* CONFIG_FILS || CONFIG_SHA384 */
2479 } else if (wpa_key_mgmt_sha256(akmp)) {
2480 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-256");
2481 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
2482 } else {
2483 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-1");
2484 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
2485 }
2486 wpa_hexdump(MSG_DEBUG, "RSN: Derived PMKID", hash, PMKID_LEN);
2487 os_memcpy(pmkid, hash, PMKID_LEN);
2488 }
2489
2490
2491 #ifdef CONFIG_SUITEB
2492 /**
2493 * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
2494 * @kck: Key confirmation key
2495 * @kck_len: Length of kck in bytes
2496 * @aa: Authenticator address
2497 * @spa: Supplicant address
2498 * @pmkid: Buffer for PMKID
2499 * Returns: 0 on success, -1 on failure
2500 *
2501 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2502 * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
2503 */
rsn_pmkid_suite_b(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2504 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
2505 const u8 *spa, u8 *pmkid)
2506 {
2507 char *title = "PMK Name";
2508 const u8 *addr[3];
2509 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2510 unsigned char hash[SHA256_MAC_LEN];
2511
2512 addr[0] = (u8 *) title;
2513 addr[1] = aa;
2514 addr[2] = spa;
2515
2516 if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
2517 return -1;
2518 os_memcpy(pmkid, hash, PMKID_LEN);
2519 return 0;
2520 }
2521 #endif /* CONFIG_SUITEB */
2522
2523
2524 #ifdef CONFIG_SUITEB192
2525 /**
2526 * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
2527 * @kck: Key confirmation key
2528 * @kck_len: Length of kck in bytes
2529 * @aa: Authenticator address
2530 * @spa: Supplicant address
2531 * @pmkid: Buffer for PMKID
2532 * Returns: 0 on success, -1 on failure
2533 *
2534 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2535 * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
2536 */
rsn_pmkid_suite_b_192(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2537 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
2538 const u8 *spa, u8 *pmkid)
2539 {
2540 char *title = "PMK Name";
2541 const u8 *addr[3];
2542 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2543 unsigned char hash[SHA384_MAC_LEN];
2544
2545 addr[0] = (u8 *) title;
2546 addr[1] = aa;
2547 addr[2] = spa;
2548
2549 if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
2550 return -1;
2551 os_memcpy(pmkid, hash, PMKID_LEN);
2552 return 0;
2553 }
2554 #endif /* CONFIG_SUITEB192 */
2555
2556
2557 /**
2558 * wpa_cipher_txt - Convert cipher suite to a text string
2559 * @cipher: Cipher suite (WPA_CIPHER_* enum)
2560 * Returns: Pointer to a text string of the cipher suite name
2561 */
wpa_cipher_txt(int cipher)2562 const char * wpa_cipher_txt(int cipher)
2563 {
2564 switch (cipher) {
2565 case WPA_CIPHER_NONE:
2566 return "NONE";
2567 #ifdef CONFIG_WEP
2568 case WPA_CIPHER_WEP40:
2569 return "WEP-40";
2570 case WPA_CIPHER_WEP104:
2571 return "WEP-104";
2572 #endif /* CONFIG_WEP */
2573 case WPA_CIPHER_TKIP:
2574 return "TKIP";
2575 case WPA_CIPHER_CCMP:
2576 return "CCMP";
2577 case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
2578 return "CCMP+TKIP";
2579 case WPA_CIPHER_GCMP:
2580 return "GCMP";
2581 case WPA_CIPHER_GCMP_256:
2582 return "GCMP-256";
2583 case WPA_CIPHER_CCMP_256:
2584 return "CCMP-256";
2585 case WPA_CIPHER_AES_128_CMAC:
2586 return "BIP";
2587 case WPA_CIPHER_BIP_GMAC_128:
2588 return "BIP-GMAC-128";
2589 case WPA_CIPHER_BIP_GMAC_256:
2590 return "BIP-GMAC-256";
2591 case WPA_CIPHER_BIP_CMAC_256:
2592 return "BIP-CMAC-256";
2593 case WPA_CIPHER_GTK_NOT_USED:
2594 return "GTK_NOT_USED";
2595 default:
2596 return "UNKNOWN";
2597 }
2598 }
2599
2600
2601 /**
2602 * wpa_key_mgmt_txt - Convert key management suite to a text string
2603 * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
2604 * @proto: WPA/WPA2 version (WPA_PROTO_*)
2605 * Returns: Pointer to a text string of the key management suite name
2606 */
wpa_key_mgmt_txt(int key_mgmt,int proto)2607 const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
2608 {
2609 switch (key_mgmt) {
2610 case WPA_KEY_MGMT_IEEE8021X:
2611 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2612 return "WPA2+WPA/IEEE 802.1X/EAP";
2613 return proto == WPA_PROTO_RSN ?
2614 "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
2615 case WPA_KEY_MGMT_PSK:
2616 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2617 return "WPA2-PSK+WPA-PSK";
2618 return proto == WPA_PROTO_RSN ?
2619 "WPA2-PSK" : "WPA-PSK";
2620 case WPA_KEY_MGMT_NONE:
2621 return "NONE";
2622 case WPA_KEY_MGMT_WPA_NONE:
2623 return "WPA-NONE";
2624 case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
2625 return "IEEE 802.1X (no WPA)";
2626 #ifdef CONFIG_IEEE80211R
2627 case WPA_KEY_MGMT_FT_IEEE8021X:
2628 return "FT-EAP";
2629 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
2630 return "FT-EAP-SHA384";
2631 case WPA_KEY_MGMT_FT_PSK:
2632 return "FT-PSK";
2633 #endif /* CONFIG_IEEE80211R */
2634 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2635 return "WPA2-EAP-SHA256";
2636 case WPA_KEY_MGMT_PSK_SHA256:
2637 return "WPA2-PSK-SHA256";
2638 case WPA_KEY_MGMT_WPS:
2639 return "WPS";
2640 case WPA_KEY_MGMT_SAE:
2641 return "SAE";
2642 case WPA_KEY_MGMT_SAE_EXT_KEY:
2643 return "SAE-EXT-KEY";
2644 case WPA_KEY_MGMT_FT_SAE:
2645 return "FT-SAE";
2646 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
2647 return "FT-SAE-EXT-KEY";
2648 case WPA_KEY_MGMT_OSEN:
2649 return "OSEN";
2650 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2651 return "WPA2-EAP-SUITE-B";
2652 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2653 return "WPA2-EAP-SUITE-B-192";
2654 case WPA_KEY_MGMT_FILS_SHA256:
2655 return "FILS-SHA256";
2656 case WPA_KEY_MGMT_FILS_SHA384:
2657 return "FILS-SHA384";
2658 case WPA_KEY_MGMT_FT_FILS_SHA256:
2659 return "FT-FILS-SHA256";
2660 case WPA_KEY_MGMT_FT_FILS_SHA384:
2661 return "FT-FILS-SHA384";
2662 case WPA_KEY_MGMT_OWE:
2663 return "OWE";
2664 case WPA_KEY_MGMT_DPP:
2665 return "DPP";
2666 case WPA_KEY_MGMT_PASN:
2667 return "PASN";
2668 default:
2669 return "UNKNOWN";
2670 }
2671 }
2672
2673
wpa_akm_to_suite(int akm)2674 u32 wpa_akm_to_suite(int akm)
2675 {
2676 if (akm & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
2677 return RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
2678 if (akm & WPA_KEY_MGMT_FT_IEEE8021X)
2679 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2680 if (akm & WPA_KEY_MGMT_FT_PSK)
2681 return RSN_AUTH_KEY_MGMT_FT_PSK;
2682 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
2683 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2684 if (akm & WPA_KEY_MGMT_IEEE8021X)
2685 return RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
2686 if (akm & WPA_KEY_MGMT_PSK_SHA256)
2687 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2688 if (akm & WPA_KEY_MGMT_PSK)
2689 return RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
2690 if (akm & WPA_KEY_MGMT_CCKM)
2691 return RSN_AUTH_KEY_MGMT_CCKM;
2692 if (akm & WPA_KEY_MGMT_OSEN)
2693 return RSN_AUTH_KEY_MGMT_OSEN;
2694 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
2695 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2696 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2697 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2698 if (akm & WPA_KEY_MGMT_FILS_SHA256)
2699 return RSN_AUTH_KEY_MGMT_FILS_SHA256;
2700 if (akm & WPA_KEY_MGMT_FILS_SHA384)
2701 return RSN_AUTH_KEY_MGMT_FILS_SHA384;
2702 if (akm & WPA_KEY_MGMT_FT_FILS_SHA256)
2703 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
2704 if (akm & WPA_KEY_MGMT_FT_FILS_SHA384)
2705 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
2706 if (akm & WPA_KEY_MGMT_SAE)
2707 return RSN_AUTH_KEY_MGMT_SAE;
2708 if (akm & WPA_KEY_MGMT_SAE_EXT_KEY)
2709 return RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
2710 if (akm & WPA_KEY_MGMT_FT_SAE)
2711 return RSN_AUTH_KEY_MGMT_FT_SAE;
2712 if (akm & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
2713 return RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY;
2714 if (akm & WPA_KEY_MGMT_OWE)
2715 return RSN_AUTH_KEY_MGMT_OWE;
2716 if (akm & WPA_KEY_MGMT_DPP)
2717 return RSN_AUTH_KEY_MGMT_DPP;
2718 return 0;
2719 }
2720
2721
wpa_compare_rsn_ie(int ft_initial_assoc,const u8 * ie1,size_t ie1len,const u8 * ie2,size_t ie2len)2722 int wpa_compare_rsn_ie(int ft_initial_assoc,
2723 const u8 *ie1, size_t ie1len,
2724 const u8 *ie2, size_t ie2len)
2725 {
2726 if (ie1 == NULL || ie2 == NULL)
2727 return -1;
2728
2729 if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
2730 return 0; /* identical IEs */
2731
2732 #ifdef CONFIG_IEEE80211R
2733 if (ft_initial_assoc) {
2734 struct wpa_ie_data ie1d, ie2d;
2735 /*
2736 * The PMKID-List in RSN IE is different between Beacon/Probe
2737 * Response/(Re)Association Request frames and EAPOL-Key
2738 * messages in FT initial mobility domain association. Allow
2739 * for this, but verify that other parts of the RSN IEs are
2740 * identical.
2741 */
2742 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
2743 wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
2744 return -1;
2745 if (ie1d.proto == ie2d.proto &&
2746 ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
2747 ie1d.group_cipher == ie2d.group_cipher &&
2748 ie1d.key_mgmt == ie2d.key_mgmt &&
2749 ie1d.capabilities == ie2d.capabilities &&
2750 ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
2751 return 0;
2752 }
2753 #endif /* CONFIG_IEEE80211R */
2754
2755 return -1;
2756 }
2757
2758
wpa_insert_pmkid(u8 * ies,size_t * ies_len,const u8 * pmkid)2759 int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid)
2760 {
2761 u8 *start, *end, *rpos, *rend;
2762 int added = 0;
2763
2764 start = ies;
2765 end = ies + *ies_len;
2766
2767 while (start < end) {
2768 if (*start == WLAN_EID_RSN)
2769 break;
2770 start += 2 + start[1];
2771 }
2772 if (start >= end) {
2773 wpa_printf(MSG_ERROR, "RSN: Could not find RSNE in IEs data");
2774 return -1;
2775 }
2776 wpa_hexdump(MSG_DEBUG, "RSN: RSNE before modification",
2777 start, 2 + start[1]);
2778
2779 /* Find start of PMKID-Count */
2780 rpos = start + 2;
2781 rend = rpos + start[1];
2782
2783 /* Skip Version and Group Data Cipher Suite */
2784 rpos += 2 + 4;
2785 /* Skip Pairwise Cipher Suite Count and List */
2786 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2787 /* Skip AKM Suite Count and List */
2788 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2789
2790 if (rpos == rend) {
2791 /* Add RSN Capabilities */
2792 os_memmove(rpos + 2, rpos, end - rpos);
2793 *rpos++ = 0;
2794 *rpos++ = 0;
2795 added += 2;
2796 start[1] += 2;
2797 rend = rpos;
2798 } else {
2799 /* Skip RSN Capabilities */
2800 rpos += 2;
2801 if (rpos > rend) {
2802 wpa_printf(MSG_ERROR,
2803 "RSN: Could not parse RSNE in IEs data");
2804 return -1;
2805 }
2806 }
2807
2808 if (rpos == rend) {
2809 /* No PMKID-Count field included; add it */
2810 os_memmove(rpos + 2 + PMKID_LEN, rpos, end + added - rpos);
2811 WPA_PUT_LE16(rpos, 1);
2812 rpos += 2;
2813 os_memcpy(rpos, pmkid, PMKID_LEN);
2814 added += 2 + PMKID_LEN;
2815 start[1] += 2 + PMKID_LEN;
2816 } else {
2817 u16 num_pmkid;
2818
2819 if (rend - rpos < 2)
2820 return -1;
2821 num_pmkid = WPA_GET_LE16(rpos);
2822 /* PMKID-Count was included; use it */
2823 if (num_pmkid != 0) {
2824 u8 *after;
2825
2826 if (num_pmkid * PMKID_LEN > rend - rpos - 2)
2827 return -1;
2828 /*
2829 * PMKID may have been included in RSN IE in
2830 * (Re)Association Request frame, so remove the old
2831 * PMKID(s) first before adding the new one.
2832 */
2833 wpa_printf(MSG_DEBUG,
2834 "RSN: Remove %u old PMKID(s) from RSNE",
2835 num_pmkid);
2836 after = rpos + 2 + num_pmkid * PMKID_LEN;
2837 os_memmove(rpos + 2, after, end - after);
2838 start[1] -= num_pmkid * PMKID_LEN;
2839 added -= num_pmkid * PMKID_LEN;
2840 }
2841 WPA_PUT_LE16(rpos, 1);
2842 rpos += 2;
2843 os_memmove(rpos + PMKID_LEN, rpos, end + added - rpos);
2844 os_memcpy(rpos, pmkid, PMKID_LEN);
2845 added += PMKID_LEN;
2846 start[1] += PMKID_LEN;
2847 }
2848
2849 wpa_hexdump(MSG_DEBUG, "RSN: RSNE after modification (PMKID inserted)",
2850 start, 2 + start[1]);
2851
2852 *ies_len += added;
2853
2854 return 0;
2855 }
2856
2857
wpa_cipher_key_len(int cipher)2858 int wpa_cipher_key_len(int cipher)
2859 {
2860 switch (cipher) {
2861 case WPA_CIPHER_CCMP_256:
2862 case WPA_CIPHER_GCMP_256:
2863 case WPA_CIPHER_BIP_GMAC_256:
2864 case WPA_CIPHER_BIP_CMAC_256:
2865 return 32;
2866 case WPA_CIPHER_CCMP:
2867 case WPA_CIPHER_GCMP:
2868 case WPA_CIPHER_AES_128_CMAC:
2869 case WPA_CIPHER_BIP_GMAC_128:
2870 return 16;
2871 case WPA_CIPHER_TKIP:
2872 return 32;
2873 default:
2874 return 0;
2875 }
2876 }
2877
2878
wpa_cipher_rsc_len(int cipher)2879 int wpa_cipher_rsc_len(int cipher)
2880 {
2881 switch (cipher) {
2882 case WPA_CIPHER_CCMP_256:
2883 case WPA_CIPHER_GCMP_256:
2884 case WPA_CIPHER_CCMP:
2885 case WPA_CIPHER_GCMP:
2886 case WPA_CIPHER_TKIP:
2887 return 6;
2888 default:
2889 return 0;
2890 }
2891 }
2892
2893
wpa_cipher_to_alg(int cipher)2894 enum wpa_alg wpa_cipher_to_alg(int cipher)
2895 {
2896 switch (cipher) {
2897 case WPA_CIPHER_CCMP_256:
2898 return WPA_ALG_CCMP_256;
2899 case WPA_CIPHER_GCMP_256:
2900 return WPA_ALG_GCMP_256;
2901 case WPA_CIPHER_CCMP:
2902 return WPA_ALG_CCMP;
2903 case WPA_CIPHER_GCMP:
2904 return WPA_ALG_GCMP;
2905 case WPA_CIPHER_TKIP:
2906 return WPA_ALG_TKIP;
2907 case WPA_CIPHER_AES_128_CMAC:
2908 return WPA_ALG_BIP_CMAC_128;
2909 case WPA_CIPHER_BIP_GMAC_128:
2910 return WPA_ALG_BIP_GMAC_128;
2911 case WPA_CIPHER_BIP_GMAC_256:
2912 return WPA_ALG_BIP_GMAC_256;
2913 case WPA_CIPHER_BIP_CMAC_256:
2914 return WPA_ALG_BIP_CMAC_256;
2915 default:
2916 return WPA_ALG_NONE;
2917 }
2918 }
2919
2920
wpa_cipher_valid_pairwise(int cipher)2921 int wpa_cipher_valid_pairwise(int cipher)
2922 {
2923 #ifdef CONFIG_NO_TKIP
2924 return cipher == WPA_CIPHER_CCMP_256 ||
2925 cipher == WPA_CIPHER_GCMP_256 ||
2926 cipher == WPA_CIPHER_CCMP ||
2927 cipher == WPA_CIPHER_GCMP;
2928 #else /* CONFIG_NO_TKIP */
2929 return cipher == WPA_CIPHER_CCMP_256 ||
2930 cipher == WPA_CIPHER_GCMP_256 ||
2931 cipher == WPA_CIPHER_CCMP ||
2932 cipher == WPA_CIPHER_GCMP ||
2933 cipher == WPA_CIPHER_TKIP;
2934 #endif /* CONFIG_NO_TKIP */
2935 }
2936
2937
wpa_cipher_to_suite(int proto,int cipher)2938 u32 wpa_cipher_to_suite(int proto, int cipher)
2939 {
2940 if (cipher & WPA_CIPHER_CCMP_256)
2941 return RSN_CIPHER_SUITE_CCMP_256;
2942 if (cipher & WPA_CIPHER_GCMP_256)
2943 return RSN_CIPHER_SUITE_GCMP_256;
2944 if (cipher & WPA_CIPHER_CCMP)
2945 return (proto == WPA_PROTO_RSN ?
2946 RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
2947 if (cipher & WPA_CIPHER_GCMP)
2948 return RSN_CIPHER_SUITE_GCMP;
2949 if (cipher & WPA_CIPHER_TKIP)
2950 return (proto == WPA_PROTO_RSN ?
2951 RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
2952 if (cipher & WPA_CIPHER_NONE)
2953 return (proto == WPA_PROTO_RSN ?
2954 RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
2955 if (cipher & WPA_CIPHER_GTK_NOT_USED)
2956 return RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED;
2957 if (cipher & WPA_CIPHER_AES_128_CMAC)
2958 return RSN_CIPHER_SUITE_AES_128_CMAC;
2959 if (cipher & WPA_CIPHER_BIP_GMAC_128)
2960 return RSN_CIPHER_SUITE_BIP_GMAC_128;
2961 if (cipher & WPA_CIPHER_BIP_GMAC_256)
2962 return RSN_CIPHER_SUITE_BIP_GMAC_256;
2963 if (cipher & WPA_CIPHER_BIP_CMAC_256)
2964 return RSN_CIPHER_SUITE_BIP_CMAC_256;
2965 return 0;
2966 }
2967
2968
rsn_cipher_put_suites(u8 * start,int ciphers)2969 int rsn_cipher_put_suites(u8 *start, int ciphers)
2970 {
2971 u8 *pos = start;
2972
2973 if (ciphers & WPA_CIPHER_CCMP_256) {
2974 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP_256);
2975 pos += RSN_SELECTOR_LEN;
2976 }
2977 if (ciphers & WPA_CIPHER_GCMP_256) {
2978 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
2979 pos += RSN_SELECTOR_LEN;
2980 }
2981 if (ciphers & WPA_CIPHER_CCMP) {
2982 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2983 pos += RSN_SELECTOR_LEN;
2984 }
2985 if (ciphers & WPA_CIPHER_GCMP) {
2986 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
2987 pos += RSN_SELECTOR_LEN;
2988 }
2989 if (ciphers & WPA_CIPHER_TKIP) {
2990 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
2991 pos += RSN_SELECTOR_LEN;
2992 }
2993 if (ciphers & WPA_CIPHER_NONE) {
2994 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
2995 pos += RSN_SELECTOR_LEN;
2996 }
2997
2998 return (pos - start) / RSN_SELECTOR_LEN;
2999 }
3000
3001
wpa_cipher_put_suites(u8 * start,int ciphers)3002 int wpa_cipher_put_suites(u8 *start, int ciphers)
3003 {
3004 u8 *pos = start;
3005
3006 if (ciphers & WPA_CIPHER_CCMP) {
3007 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
3008 pos += WPA_SELECTOR_LEN;
3009 }
3010 if (ciphers & WPA_CIPHER_TKIP) {
3011 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
3012 pos += WPA_SELECTOR_LEN;
3013 }
3014 if (ciphers & WPA_CIPHER_NONE) {
3015 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
3016 pos += WPA_SELECTOR_LEN;
3017 }
3018
3019 return (pos - start) / RSN_SELECTOR_LEN;
3020 }
3021
3022
wpa_pick_pairwise_cipher(int ciphers,int none_allowed)3023 int wpa_pick_pairwise_cipher(int ciphers, int none_allowed)
3024 {
3025 if (ciphers & WPA_CIPHER_CCMP_256)
3026 return WPA_CIPHER_CCMP_256;
3027 if (ciphers & WPA_CIPHER_GCMP_256)
3028 return WPA_CIPHER_GCMP_256;
3029 if (ciphers & WPA_CIPHER_CCMP)
3030 return WPA_CIPHER_CCMP;
3031 if (ciphers & WPA_CIPHER_GCMP)
3032 return WPA_CIPHER_GCMP;
3033 if (ciphers & WPA_CIPHER_TKIP)
3034 return WPA_CIPHER_TKIP;
3035 if (none_allowed && (ciphers & WPA_CIPHER_NONE))
3036 return WPA_CIPHER_NONE;
3037 return -1;
3038 }
3039
3040
wpa_pick_group_cipher(int ciphers)3041 int wpa_pick_group_cipher(int ciphers)
3042 {
3043 if (ciphers & WPA_CIPHER_CCMP_256)
3044 return WPA_CIPHER_CCMP_256;
3045 if (ciphers & WPA_CIPHER_GCMP_256)
3046 return WPA_CIPHER_GCMP_256;
3047 if (ciphers & WPA_CIPHER_CCMP)
3048 return WPA_CIPHER_CCMP;
3049 if (ciphers & WPA_CIPHER_GCMP)
3050 return WPA_CIPHER_GCMP;
3051 if (ciphers & WPA_CIPHER_GTK_NOT_USED)
3052 return WPA_CIPHER_GTK_NOT_USED;
3053 if (ciphers & WPA_CIPHER_TKIP)
3054 return WPA_CIPHER_TKIP;
3055 return -1;
3056 }
3057
3058
wpa_parse_cipher(const char * value)3059 int wpa_parse_cipher(const char *value)
3060 {
3061 int val = 0, last;
3062 char *start, *end, *buf;
3063
3064 buf = os_strdup(value);
3065 if (buf == NULL)
3066 return -1;
3067 start = buf;
3068
3069 while (*start != '\0') {
3070 while (*start == ' ' || *start == '\t')
3071 start++;
3072 if (*start == '\0')
3073 break;
3074 end = start;
3075 while (*end != ' ' && *end != '\t' && *end != '\0')
3076 end++;
3077 last = *end == '\0';
3078 *end = '\0';
3079 if (os_strcmp(start, "CCMP-256") == 0)
3080 val |= WPA_CIPHER_CCMP_256;
3081 else if (os_strcmp(start, "GCMP-256") == 0)
3082 val |= WPA_CIPHER_GCMP_256;
3083 else if (os_strcmp(start, "CCMP") == 0)
3084 val |= WPA_CIPHER_CCMP;
3085 else if (os_strcmp(start, "GCMP") == 0)
3086 val |= WPA_CIPHER_GCMP;
3087 #ifndef CONFIG_NO_TKIP
3088 else if (os_strcmp(start, "TKIP") == 0)
3089 val |= WPA_CIPHER_TKIP;
3090 #endif /* CONFIG_NO_TKIP */
3091 #ifdef CONFIG_WEP
3092 else if (os_strcmp(start, "WEP104") == 0)
3093 val |= WPA_CIPHER_WEP104;
3094 else if (os_strcmp(start, "WEP40") == 0)
3095 val |= WPA_CIPHER_WEP40;
3096 #endif /* CONFIG_WEP */
3097 else if (os_strcmp(start, "NONE") == 0)
3098 val |= WPA_CIPHER_NONE;
3099 else if (os_strcmp(start, "GTK_NOT_USED") == 0)
3100 val |= WPA_CIPHER_GTK_NOT_USED;
3101 else if (os_strcmp(start, "AES-128-CMAC") == 0)
3102 val |= WPA_CIPHER_AES_128_CMAC;
3103 else if (os_strcmp(start, "BIP-GMAC-128") == 0)
3104 val |= WPA_CIPHER_BIP_GMAC_128;
3105 else if (os_strcmp(start, "BIP-GMAC-256") == 0)
3106 val |= WPA_CIPHER_BIP_GMAC_256;
3107 else if (os_strcmp(start, "BIP-CMAC-256") == 0)
3108 val |= WPA_CIPHER_BIP_CMAC_256;
3109 else {
3110 os_free(buf);
3111 return -1;
3112 }
3113
3114 if (last)
3115 break;
3116 start = end + 1;
3117 }
3118 os_free(buf);
3119
3120 return val;
3121 }
3122
3123
wpa_write_ciphers(char * start,char * end,int ciphers,const char * delim)3124 int wpa_write_ciphers(char *start, char *end, int ciphers, const char *delim)
3125 {
3126 char *pos = start;
3127 int ret;
3128
3129 if (ciphers & WPA_CIPHER_CCMP_256) {
3130 ret = os_snprintf(pos, end - pos, "%sCCMP-256",
3131 pos == start ? "" : delim);
3132 if (os_snprintf_error(end - pos, ret))
3133 return -1;
3134 pos += ret;
3135 }
3136 if (ciphers & WPA_CIPHER_GCMP_256) {
3137 ret = os_snprintf(pos, end - pos, "%sGCMP-256",
3138 pos == start ? "" : delim);
3139 if (os_snprintf_error(end - pos, ret))
3140 return -1;
3141 pos += ret;
3142 }
3143 if (ciphers & WPA_CIPHER_CCMP) {
3144 ret = os_snprintf(pos, end - pos, "%sCCMP",
3145 pos == start ? "" : delim);
3146 if (os_snprintf_error(end - pos, ret))
3147 return -1;
3148 pos += ret;
3149 }
3150 if (ciphers & WPA_CIPHER_GCMP) {
3151 ret = os_snprintf(pos, end - pos, "%sGCMP",
3152 pos == start ? "" : delim);
3153 if (os_snprintf_error(end - pos, ret))
3154 return -1;
3155 pos += ret;
3156 }
3157 if (ciphers & WPA_CIPHER_TKIP) {
3158 ret = os_snprintf(pos, end - pos, "%sTKIP",
3159 pos == start ? "" : delim);
3160 if (os_snprintf_error(end - pos, ret))
3161 return -1;
3162 pos += ret;
3163 }
3164 if (ciphers & WPA_CIPHER_AES_128_CMAC) {
3165 ret = os_snprintf(pos, end - pos, "%sAES-128-CMAC",
3166 pos == start ? "" : delim);
3167 if (os_snprintf_error(end - pos, ret))
3168 return -1;
3169 pos += ret;
3170 }
3171 if (ciphers & WPA_CIPHER_BIP_GMAC_128) {
3172 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-128",
3173 pos == start ? "" : delim);
3174 if (os_snprintf_error(end - pos, ret))
3175 return -1;
3176 pos += ret;
3177 }
3178 if (ciphers & WPA_CIPHER_BIP_GMAC_256) {
3179 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-256",
3180 pos == start ? "" : delim);
3181 if (os_snprintf_error(end - pos, ret))
3182 return -1;
3183 pos += ret;
3184 }
3185 if (ciphers & WPA_CIPHER_BIP_CMAC_256) {
3186 ret = os_snprintf(pos, end - pos, "%sBIP-CMAC-256",
3187 pos == start ? "" : delim);
3188 if (os_snprintf_error(end - pos, ret))
3189 return -1;
3190 pos += ret;
3191 }
3192 if (ciphers & WPA_CIPHER_NONE) {
3193 ret = os_snprintf(pos, end - pos, "%sNONE",
3194 pos == start ? "" : delim);
3195 if (os_snprintf_error(end - pos, ret))
3196 return -1;
3197 pos += ret;
3198 }
3199
3200 return pos - start;
3201 }
3202
3203
wpa_select_ap_group_cipher(int wpa,int wpa_pairwise,int rsn_pairwise)3204 int wpa_select_ap_group_cipher(int wpa, int wpa_pairwise, int rsn_pairwise)
3205 {
3206 int pairwise = 0;
3207
3208 /* Select group cipher based on the enabled pairwise cipher suites */
3209 if (wpa & 1)
3210 pairwise |= wpa_pairwise;
3211 if (wpa & 2)
3212 pairwise |= rsn_pairwise;
3213
3214 if (pairwise & WPA_CIPHER_TKIP)
3215 return WPA_CIPHER_TKIP;
3216 if ((pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP)
3217 return WPA_CIPHER_GCMP;
3218 if ((pairwise & (WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP |
3219 WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP_256)
3220 return WPA_CIPHER_GCMP_256;
3221 if ((pairwise & (WPA_CIPHER_CCMP_256 | WPA_CIPHER_CCMP |
3222 WPA_CIPHER_GCMP)) == WPA_CIPHER_CCMP_256)
3223 return WPA_CIPHER_CCMP_256;
3224 return WPA_CIPHER_CCMP;
3225 }
3226
3227
3228 #ifdef CONFIG_FILS
fils_domain_name_hash(const char * domain,u8 * hash)3229 int fils_domain_name_hash(const char *domain, u8 *hash)
3230 {
3231 char buf[255], *wpos = buf;
3232 const char *pos = domain;
3233 size_t len;
3234 const u8 *addr[1];
3235 u8 mac[SHA256_MAC_LEN];
3236
3237 for (len = 0; len < sizeof(buf) && *pos; len++) {
3238 if (isalpha(*pos) && isupper(*pos))
3239 *wpos++ = tolower(*pos);
3240 else
3241 *wpos++ = *pos;
3242 pos++;
3243 }
3244
3245 addr[0] = (const u8 *) buf;
3246 if (sha256_vector(1, addr, &len, mac) < 0)
3247 return -1;
3248 os_memcpy(hash, mac, 2);
3249 return 0;
3250 }
3251 #endif /* CONFIG_FILS */
3252
3253
3254 /**
3255 * wpa_parse_vendor_specific - Parse Vendor Specific IEs
3256 * @pos: Pointer to the IE header
3257 * @end: Pointer to the end of the Key Data buffer
3258 * @ie: Pointer to parsed IE data
3259 */
wpa_parse_vendor_specific(const u8 * pos,const u8 * end,struct wpa_eapol_ie_parse * ie)3260 static void wpa_parse_vendor_specific(const u8 *pos, const u8 *end,
3261 struct wpa_eapol_ie_parse *ie)
3262 {
3263 unsigned int oui;
3264
3265 if (pos[1] < 4) {
3266 wpa_printf(MSG_MSGDUMP,
3267 "Too short vendor specific IE ignored (len=%u)",
3268 pos[1]);
3269 return;
3270 }
3271
3272 oui = WPA_GET_BE24(&pos[2]);
3273 if (oui == OUI_MICROSOFT && pos[5] == WMM_OUI_TYPE && pos[1] > 4) {
3274 if (pos[6] == WMM_OUI_SUBTYPE_INFORMATION_ELEMENT) {
3275 ie->wmm = &pos[2];
3276 ie->wmm_len = pos[1];
3277 wpa_hexdump(MSG_DEBUG, "WPA: WMM IE",
3278 ie->wmm, ie->wmm_len);
3279 } else if (pos[6] == WMM_OUI_SUBTYPE_PARAMETER_ELEMENT) {
3280 ie->wmm = &pos[2];
3281 ie->wmm_len = pos[1];
3282 wpa_hexdump(MSG_DEBUG, "WPA: WMM Parameter Element",
3283 ie->wmm, ie->wmm_len);
3284 }
3285 }
3286 }
3287
3288
3289 /**
3290 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
3291 * @pos: Pointer to the IE header
3292 * @ie: Pointer to parsed IE data
3293 * Returns: 0 on success, 1 if end mark is found, 2 if KDE is not recognized
3294 */
wpa_parse_generic(const u8 * pos,struct wpa_eapol_ie_parse * ie)3295 static int wpa_parse_generic(const u8 *pos, struct wpa_eapol_ie_parse *ie)
3296 {
3297 u8 len = pos[1];
3298 size_t dlen = 2 + len;
3299 u32 selector;
3300 const u8 *p;
3301 size_t left;
3302 u8 link_id;
3303 char title[50];
3304 int ret;
3305
3306 if (len == 0)
3307 return 1;
3308
3309 if (len < RSN_SELECTOR_LEN)
3310 return 2;
3311
3312 p = pos + 2;
3313 selector = RSN_SELECTOR_GET(p);
3314 p += RSN_SELECTOR_LEN;
3315 left = len - RSN_SELECTOR_LEN;
3316
3317 if (left >= 2 && selector == WPA_OUI_TYPE && p[0] == 1 && p[1] == 0) {
3318 ie->wpa_ie = pos;
3319 ie->wpa_ie_len = dlen;
3320 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE in EAPOL-Key",
3321 ie->wpa_ie, ie->wpa_ie_len);
3322 return 0;
3323 }
3324
3325 if (selector == OSEN_IE_VENDOR_TYPE) {
3326 ie->osen = pos;
3327 ie->osen_len = dlen;
3328 return 0;
3329 }
3330
3331 if (left >= PMKID_LEN && selector == RSN_KEY_DATA_PMKID) {
3332 ie->pmkid = p;
3333 wpa_hexdump(MSG_DEBUG, "WPA: PMKID in EAPOL-Key", pos, dlen);
3334 return 0;
3335 }
3336
3337 if (left >= 2 && selector == RSN_KEY_DATA_KEYID) {
3338 ie->key_id = p;
3339 wpa_hexdump(MSG_DEBUG, "WPA: KeyID in EAPOL-Key", pos, dlen);
3340 return 0;
3341 }
3342
3343 if (left > 2 && selector == RSN_KEY_DATA_GROUPKEY) {
3344 ie->gtk = p;
3345 ie->gtk_len = left;
3346 wpa_hexdump_key(MSG_DEBUG, "WPA: GTK in EAPOL-Key", pos, dlen);
3347 return 0;
3348 }
3349
3350 if (left >= ETH_ALEN && selector == RSN_KEY_DATA_MAC_ADDR) {
3351 ie->mac_addr = p;
3352 wpa_printf(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key: " MACSTR,
3353 MAC2STR(ie->mac_addr));
3354 return 0;
3355 }
3356
3357 if (left > 2 && selector == RSN_KEY_DATA_IGTK) {
3358 ie->igtk = p;
3359 ie->igtk_len = left;
3360 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK in EAPOL-Key",
3361 pos, dlen);
3362 return 0;
3363 }
3364
3365 if (left > 2 && selector == RSN_KEY_DATA_BIGTK) {
3366 ie->bigtk = p;
3367 ie->bigtk_len = left;
3368 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK in EAPOL-Key",
3369 pos, dlen);
3370 return 0;
3371 }
3372
3373 if (left >= 1 && selector == WFA_KEY_DATA_IP_ADDR_REQ) {
3374 ie->ip_addr_req = p;
3375 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key",
3376 ie->ip_addr_req, left);
3377 return 0;
3378 }
3379
3380 if (left >= 3 * 4 && selector == WFA_KEY_DATA_IP_ADDR_ALLOC) {
3381 ie->ip_addr_alloc = p;
3382 wpa_hexdump(MSG_DEBUG,
3383 "WPA: IP Address Allocation in EAPOL-Key",
3384 ie->ip_addr_alloc, left);
3385 return 0;
3386 }
3387
3388 if (left > 2 && selector == RSN_KEY_DATA_OCI) {
3389 ie->oci = p;
3390 ie->oci_len = left;
3391 wpa_hexdump(MSG_DEBUG, "WPA: OCI KDE in EAPOL-Key",
3392 pos, dlen);
3393 return 0;
3394 }
3395
3396 if (left >= 1 && selector == WFA_KEY_DATA_TRANSITION_DISABLE) {
3397 ie->transition_disable = p;
3398 ie->transition_disable_len = left;
3399 wpa_hexdump(MSG_DEBUG,
3400 "WPA: Transition Disable KDE in EAPOL-Key",
3401 pos, dlen);
3402 return 0;
3403 }
3404
3405 if (left >= 2 && selector == WFA_KEY_DATA_DPP) {
3406 ie->dpp_kde = p;
3407 ie->dpp_kde_len = left;
3408 wpa_hexdump(MSG_DEBUG, "WPA: DPP KDE in EAPOL-Key", pos, dlen);
3409 return 0;
3410 }
3411
3412 if (left >= RSN_MLO_GTK_KDE_PREFIX_LENGTH &&
3413 selector == RSN_KEY_DATA_MLO_GTK) {
3414 link_id = (p[0] & RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_MASK) >>
3415 RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_SHIFT;
3416 if (link_id >= MAX_NUM_MLO_LINKS)
3417 return 2;
3418
3419 ie->valid_mlo_gtks |= BIT(link_id);
3420 ie->mlo_gtk[link_id] = p;
3421 ie->mlo_gtk_len[link_id] = left;
3422 ret = os_snprintf(title, sizeof(title),
3423 "RSN: Link ID %u - MLO GTK KDE in EAPOL-Key",
3424 link_id);
3425 if (!os_snprintf_error(sizeof(title), ret))
3426 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3427 return 0;
3428 }
3429
3430 if (left >= RSN_MLO_IGTK_KDE_PREFIX_LENGTH &&
3431 selector == RSN_KEY_DATA_MLO_IGTK) {
3432 link_id = (p[8] & RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3433 RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3434 if (link_id >= MAX_NUM_MLO_LINKS)
3435 return 2;
3436
3437 ie->valid_mlo_igtks |= BIT(link_id);
3438 ie->mlo_igtk[link_id] = p;
3439 ie->mlo_igtk_len[link_id] = left;
3440 ret = os_snprintf(title, sizeof(title),
3441 "RSN: Link ID %u - MLO IGTK KDE in EAPOL-Key",
3442 link_id);
3443 if (!os_snprintf_error(sizeof(title), ret))
3444 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3445 return 0;
3446 }
3447
3448 if (left >= RSN_MLO_BIGTK_KDE_PREFIX_LENGTH &&
3449 selector == RSN_KEY_DATA_MLO_BIGTK) {
3450 link_id = (p[8] & RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3451 RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3452 if (link_id >= MAX_NUM_MLO_LINKS)
3453 return 2;
3454
3455 ie->valid_mlo_bigtks |= BIT(link_id);
3456 ie->mlo_bigtk[link_id] = p;
3457 ie->mlo_bigtk_len[link_id] = left;
3458 ret = os_snprintf(title, sizeof(title),
3459 "RSN: Link ID %u - MLO BIGTK KDE in EAPOL-Key",
3460 link_id);
3461 if (!os_snprintf_error(sizeof(title), ret))
3462 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3463 return 0;
3464 }
3465
3466 if (left >= RSN_MLO_LINK_KDE_FIXED_LENGTH &&
3467 selector == RSN_KEY_DATA_MLO_LINK) {
3468 link_id = (p[0] & RSN_MLO_LINK_KDE_LI_LINK_ID_MASK) >>
3469 RSN_MLO_LINK_KDE_LI_LINK_ID_SHIFT;
3470 if (link_id >= MAX_NUM_MLO_LINKS)
3471 return 2;
3472
3473 ie->valid_mlo_links |= BIT(link_id);
3474 ie->mlo_link[link_id] = p;
3475 ie->mlo_link_len[link_id] = left;
3476 ret = os_snprintf(title, sizeof(title),
3477 "RSN: Link ID %u - MLO Link KDE in EAPOL-Key",
3478 link_id);
3479 if (!os_snprintf_error(sizeof(title), ret))
3480 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
3481 return 0;
3482 }
3483
3484 return 2;
3485 }
3486
3487
3488 /**
3489 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
3490 * @buf: Pointer to the Key Data buffer
3491 * @len: Key Data Length
3492 * @ie: Pointer to parsed IE data
3493 * Returns: 0 on success, -1 on failure
3494 */
wpa_parse_kde_ies(const u8 * buf,size_t len,struct wpa_eapol_ie_parse * ie)3495 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
3496 {
3497 const u8 *pos, *end;
3498 int ret = 0;
3499 size_t dlen = 0;
3500
3501 os_memset(ie, 0, sizeof(*ie));
3502 for (pos = buf, end = pos + len; end - pos > 1; pos += dlen) {
3503 if (pos[0] == 0xdd &&
3504 ((pos == buf + len - 1) || pos[1] == 0)) {
3505 /* Ignore padding */
3506 break;
3507 }
3508 dlen = 2 + pos[1];
3509 if ((int) dlen > end - pos) {
3510 wpa_printf(MSG_DEBUG,
3511 "WPA: EAPOL-Key Key Data underflow (ie=%d len=%d pos=%d)",
3512 pos[0], pos[1], (int) (pos - buf));
3513 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", buf, len);
3514 ret = -1;
3515 break;
3516 }
3517 if (*pos == WLAN_EID_RSN) {
3518 ie->rsn_ie = pos;
3519 ie->rsn_ie_len = dlen;
3520 wpa_hexdump(MSG_DEBUG, "WPA: RSN IE in EAPOL-Key",
3521 ie->rsn_ie, ie->rsn_ie_len);
3522 } else if (*pos == WLAN_EID_RSNX) {
3523 ie->rsnxe = pos;
3524 ie->rsnxe_len = dlen;
3525 wpa_hexdump(MSG_DEBUG, "WPA: RSNXE in EAPOL-Key",
3526 ie->rsnxe, ie->rsnxe_len);
3527 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
3528 ie->mdie = pos;
3529 ie->mdie_len = dlen;
3530 wpa_hexdump(MSG_DEBUG, "WPA: MDIE in EAPOL-Key",
3531 ie->mdie, ie->mdie_len);
3532 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) {
3533 ie->ftie = pos;
3534 ie->ftie_len = dlen;
3535 wpa_hexdump(MSG_DEBUG, "WPA: FTIE in EAPOL-Key",
3536 ie->ftie, ie->ftie_len);
3537 } else if (*pos == WLAN_EID_TIMEOUT_INTERVAL && pos[1] >= 5) {
3538 if (pos[2] == WLAN_TIMEOUT_REASSOC_DEADLINE) {
3539 ie->reassoc_deadline = pos;
3540 wpa_hexdump(MSG_DEBUG, "WPA: Reassoc Deadline "
3541 "in EAPOL-Key",
3542 ie->reassoc_deadline, dlen);
3543 } else if (pos[2] == WLAN_TIMEOUT_KEY_LIFETIME) {
3544 ie->key_lifetime = pos;
3545 wpa_hexdump(MSG_DEBUG, "WPA: KeyLifetime "
3546 "in EAPOL-Key",
3547 ie->key_lifetime, dlen);
3548 } else {
3549 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized "
3550 "EAPOL-Key Key Data IE",
3551 pos, dlen);
3552 }
3553 } else if (*pos == WLAN_EID_LINK_ID) {
3554 if (pos[1] >= 18) {
3555 ie->lnkid = pos;
3556 ie->lnkid_len = dlen;
3557 }
3558 } else if (*pos == WLAN_EID_EXT_CAPAB) {
3559 ie->ext_capab = pos;
3560 ie->ext_capab_len = dlen;
3561 } else if (*pos == WLAN_EID_SUPP_RATES) {
3562 ie->supp_rates = pos;
3563 ie->supp_rates_len = dlen;
3564 } else if (*pos == WLAN_EID_EXT_SUPP_RATES) {
3565 ie->ext_supp_rates = pos;
3566 ie->ext_supp_rates_len = dlen;
3567 } else if (*pos == WLAN_EID_HT_CAP &&
3568 pos[1] >= sizeof(struct ieee80211_ht_capabilities)) {
3569 ie->ht_capabilities = pos + 2;
3570 } else if (*pos == WLAN_EID_AID) {
3571 if (pos[1] >= 2)
3572 ie->aid = WPA_GET_LE16(pos + 2) & 0x3fff;
3573 } else if (*pos == WLAN_EID_VHT_CAP &&
3574 pos[1] >= sizeof(struct ieee80211_vht_capabilities))
3575 {
3576 ie->vht_capabilities = pos + 2;
3577 } else if (*pos == WLAN_EID_EXTENSION &&
3578 pos[1] >= 1 + IEEE80211_HE_CAPAB_MIN_LEN &&
3579 pos[2] == WLAN_EID_EXT_HE_CAPABILITIES) {
3580 ie->he_capabilities = pos + 3;
3581 ie->he_capab_len = pos[1] - 1;
3582 } else if (*pos == WLAN_EID_EXTENSION &&
3583 pos[1] >= 1 +
3584 sizeof(struct ieee80211_he_6ghz_band_cap) &&
3585 pos[2] == WLAN_EID_EXT_HE_6GHZ_BAND_CAP) {
3586 ie->he_6ghz_capabilities = pos + 3;
3587 } else if (*pos == WLAN_EID_QOS && pos[1] >= 1) {
3588 ie->qosinfo = pos[2];
3589 } else if (*pos == WLAN_EID_SUPPORTED_CHANNELS) {
3590 ie->supp_channels = pos + 2;
3591 ie->supp_channels_len = pos[1];
3592 } else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) {
3593 /*
3594 * The value of the Length field of the Supported
3595 * Operating Classes element is between 2 and 253.
3596 * Silently skip invalid elements to avoid interop
3597 * issues when trying to use the value.
3598 */
3599 if (pos[1] >= 2 && pos[1] <= 253) {
3600 ie->supp_oper_classes = pos + 2;
3601 ie->supp_oper_classes_len = pos[1];
3602 }
3603 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
3604 ret = wpa_parse_generic(pos, ie);
3605 if (ret == 1) {
3606 /* end mark found */
3607 ret = 0;
3608 break;
3609 }
3610
3611 if (ret == 2) {
3612 /* not a known KDE */
3613 wpa_parse_vendor_specific(pos, end, ie);
3614 }
3615
3616 ret = 0;
3617 } else {
3618 wpa_hexdump(MSG_DEBUG,
3619 "WPA: Unrecognized EAPOL-Key Key Data IE",
3620 pos, dlen);
3621 }
3622 }
3623
3624 return ret;
3625 }
3626
3627
3628 #ifdef CONFIG_PASN
3629
3630 /*
3631 * wpa_pasn_build_auth_header - Add the MAC header and initialize Authentication
3632 * frame for PASN
3633 *
3634 * @buf: Buffer in which the header will be added
3635 * @bssid: The BSSID of the AP
3636 * @src: Source address
3637 * @dst: Destination address
3638 * @trans_seq: Authentication transaction sequence number
3639 * @status: Authentication status
3640 */
wpa_pasn_build_auth_header(struct wpabuf * buf,const u8 * bssid,const u8 * src,const u8 * dst,u8 trans_seq,u16 status)3641 void wpa_pasn_build_auth_header(struct wpabuf *buf, const u8 *bssid,
3642 const u8 *src, const u8 *dst,
3643 u8 trans_seq, u16 status)
3644 {
3645 struct ieee80211_mgmt *auth;
3646
3647 wpa_printf(MSG_DEBUG, "PASN: Add authentication header. trans_seq=%u",
3648 trans_seq);
3649
3650 auth = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
3651 u.auth.variable));
3652
3653 auth->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
3654 (WLAN_FC_STYPE_AUTH << 4));
3655
3656 os_memcpy(auth->da, dst, ETH_ALEN);
3657 os_memcpy(auth->sa, src, ETH_ALEN);
3658 os_memcpy(auth->bssid, bssid, ETH_ALEN);
3659 auth->seq_ctrl = 0;
3660
3661 auth->u.auth.auth_alg = host_to_le16(WLAN_AUTH_PASN);
3662 auth->u.auth.auth_transaction = host_to_le16(trans_seq);
3663 auth->u.auth.status_code = host_to_le16(status);
3664 }
3665
3666
3667 /*
3668 * wpa_pasn_add_rsne - Add an RSNE for PASN authentication
3669 * @buf: Buffer in which the IE will be added
3670 * @pmkid: Optional PMKID. Can be NULL.
3671 * @akmp: Authentication and key management protocol
3672 * @cipher: The cipher suite
3673 */
wpa_pasn_add_rsne(struct wpabuf * buf,const u8 * pmkid,int akmp,int cipher)3674 int wpa_pasn_add_rsne(struct wpabuf *buf, const u8 *pmkid, int akmp, int cipher)
3675 {
3676 struct rsn_ie_hdr *hdr;
3677 u32 suite;
3678 u16 capab;
3679 u8 *pos;
3680 u8 rsne_len;
3681
3682 wpa_printf(MSG_DEBUG, "PASN: Add RSNE");
3683
3684 rsne_len = sizeof(*hdr) + RSN_SELECTOR_LEN +
3685 2 + RSN_SELECTOR_LEN + 2 + RSN_SELECTOR_LEN +
3686 2 + RSN_SELECTOR_LEN + 2 + (pmkid ? PMKID_LEN : 0);
3687
3688 if (wpabuf_tailroom(buf) < rsne_len)
3689 return -1;
3690 hdr = wpabuf_put(buf, rsne_len);
3691 hdr->elem_id = WLAN_EID_RSN;
3692 hdr->len = rsne_len - 2;
3693 WPA_PUT_LE16(hdr->version, RSN_VERSION);
3694 pos = (u8 *) (hdr + 1);
3695
3696 /* Group addressed data is not allowed */
3697 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3698 pos += RSN_SELECTOR_LEN;
3699
3700 /* Add the pairwise cipher */
3701 WPA_PUT_LE16(pos, 1);
3702 pos += 2;
3703 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, cipher);
3704 RSN_SELECTOR_PUT(pos, suite);
3705 pos += RSN_SELECTOR_LEN;
3706
3707 /* Add the AKM suite */
3708 WPA_PUT_LE16(pos, 1);
3709 pos += 2;
3710
3711 switch (akmp) {
3712 case WPA_KEY_MGMT_PASN:
3713 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PASN);
3714 break;
3715 #ifdef CONFIG_SAE
3716 case WPA_KEY_MGMT_SAE:
3717 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
3718 break;
3719 case WPA_KEY_MGMT_SAE_EXT_KEY:
3720 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE_EXT_KEY);
3721 break;
3722 #endif /* CONFIG_SAE */
3723 #ifdef CONFIG_FILS
3724 case WPA_KEY_MGMT_FILS_SHA256:
3725 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
3726 break;
3727 case WPA_KEY_MGMT_FILS_SHA384:
3728 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
3729 break;
3730 #endif /* CONFIG_FILS */
3731 #ifdef CONFIG_IEEE80211R
3732 case WPA_KEY_MGMT_FT_PSK:
3733 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
3734 break;
3735 case WPA_KEY_MGMT_FT_IEEE8021X:
3736 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
3737 break;
3738 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
3739 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
3740 break;
3741 #endif /* CONFIG_IEEE80211R */
3742 default:
3743 wpa_printf(MSG_ERROR, "PASN: Invalid AKMP=0x%x", akmp);
3744 return -1;
3745 }
3746 pos += RSN_SELECTOR_LEN;
3747
3748 /* RSN Capabilities: PASN mandates both MFP capable and required */
3749 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
3750 WPA_PUT_LE16(pos, capab);
3751 pos += 2;
3752
3753 if (pmkid) {
3754 wpa_printf(MSG_DEBUG, "PASN: Adding PMKID");
3755
3756 WPA_PUT_LE16(pos, 1);
3757 pos += 2;
3758 os_memcpy(pos, pmkid, PMKID_LEN);
3759 pos += PMKID_LEN;
3760 } else {
3761 WPA_PUT_LE16(pos, 0);
3762 pos += 2;
3763 }
3764
3765 /* Group addressed management is not allowed */
3766 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3767
3768 return 0;
3769 }
3770
3771
3772 /*
3773 * wpa_pasn_add_parameter_ie - Add PASN Parameters IE for PASN authentication
3774 * @buf: Buffer in which the IE will be added
3775 * @pasn_group: Finite Cyclic Group ID for PASN authentication
3776 * @wrapped_data_format: Format of the data in the Wrapped Data IE
3777 * @pubkey: A buffer holding the local public key. Can be NULL
3778 * @compressed: In case pubkey is included, indicates if the public key is
3779 * compressed (only x coordinate is included) or not (both x and y
3780 * coordinates are included)
3781 * @comeback: A buffer holding the comeback token. Can be NULL
3782 * @after: If comeback is set, defined the comeback time in seconds. -1 to not
3783 * include the Comeback After field (frames from non-AP STA).
3784 */
wpa_pasn_add_parameter_ie(struct wpabuf * buf,u16 pasn_group,u8 wrapped_data_format,const struct wpabuf * pubkey,bool compressed,const struct wpabuf * comeback,int after)3785 void wpa_pasn_add_parameter_ie(struct wpabuf *buf, u16 pasn_group,
3786 u8 wrapped_data_format,
3787 const struct wpabuf *pubkey, bool compressed,
3788 const struct wpabuf *comeback, int after)
3789 {
3790 struct pasn_parameter_ie *params;
3791
3792 wpa_printf(MSG_DEBUG, "PASN: Add PASN Parameters element");
3793
3794 params = wpabuf_put(buf, sizeof(*params));
3795
3796 params->id = WLAN_EID_EXTENSION;
3797 params->len = sizeof(*params) - 2;
3798 params->id_ext = WLAN_EID_EXT_PASN_PARAMS;
3799 params->control = 0;
3800 params->wrapped_data_format = wrapped_data_format;
3801
3802 if (comeback) {
3803 wpa_printf(MSG_DEBUG, "PASN: Adding comeback data");
3804
3805 /*
3806 * 2 octets for the 'after' field + 1 octet for the length +
3807 * actual cookie data
3808 */
3809 if (after >= 0)
3810 params->len += 2;
3811 params->len += 1 + wpabuf_len(comeback);
3812 params->control |= WPA_PASN_CTRL_COMEBACK_INFO_PRESENT;
3813
3814 if (after >= 0)
3815 wpabuf_put_le16(buf, after);
3816 wpabuf_put_u8(buf, wpabuf_len(comeback));
3817 wpabuf_put_buf(buf, comeback);
3818 }
3819
3820 if (pubkey) {
3821 wpa_printf(MSG_DEBUG,
3822 "PASN: Adding public key and group ID %u",
3823 pasn_group);
3824
3825 /*
3826 * 2 octets for the finite cyclic group + 2 octets public key
3827 * length + 1 octet for the compressed/uncompressed indication +
3828 * the actual key.
3829 */
3830 params->len += 2 + 1 + 1 + wpabuf_len(pubkey);
3831 params->control |= WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT;
3832
3833 wpabuf_put_le16(buf, pasn_group);
3834
3835 /*
3836 * The first octet indicates whether the public key is
3837 * compressed, as defined in RFC 5480 section 2.2.
3838 */
3839 wpabuf_put_u8(buf, wpabuf_len(pubkey) + 1);
3840 wpabuf_put_u8(buf, compressed ? WPA_PASN_PUBKEY_COMPRESSED_0 :
3841 WPA_PASN_PUBKEY_UNCOMPRESSED);
3842
3843 wpabuf_put_buf(buf, pubkey);
3844 }
3845 }
3846
3847 /*
3848 * wpa_pasn_add_wrapped_data - Add a Wrapped Data IE to PASN Authentication
3849 * frame. If needed, the Wrapped Data IE would be fragmented.
3850 *
3851 * @buf: Buffer in which the IE will be added
3852 * @wrapped_data_buf: Buffer holding the wrapped data
3853 */
wpa_pasn_add_wrapped_data(struct wpabuf * buf,struct wpabuf * wrapped_data_buf)3854 int wpa_pasn_add_wrapped_data(struct wpabuf *buf,
3855 struct wpabuf *wrapped_data_buf)
3856 {
3857 const u8 *data;
3858 size_t data_len;
3859 u8 len;
3860
3861 if (!wrapped_data_buf)
3862 return 0;
3863
3864 wpa_printf(MSG_DEBUG, "PASN: Add wrapped data");
3865
3866 data = wpabuf_head_u8(wrapped_data_buf);
3867 data_len = wpabuf_len(wrapped_data_buf);
3868
3869 /* nothing to add */
3870 if (!data_len)
3871 return 0;
3872
3873 if (data_len <= 254)
3874 len = 1 + data_len;
3875 else
3876 len = 255;
3877
3878 if (wpabuf_tailroom(buf) < 3 + data_len)
3879 return -1;
3880
3881 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
3882 wpabuf_put_u8(buf, len);
3883 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
3884 wpabuf_put_data(buf, data, len - 1);
3885
3886 data += len - 1;
3887 data_len -= len - 1;
3888
3889 while (data_len) {
3890 if (wpabuf_tailroom(buf) < 1 + data_len)
3891 return -1;
3892 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
3893 len = data_len > 255 ? 255 : data_len;
3894 wpabuf_put_u8(buf, len);
3895 wpabuf_put_data(buf, data, len);
3896 data += len;
3897 data_len -= len;
3898 }
3899
3900 return 0;
3901 }
3902
3903
3904 /*
3905 * wpa_pasn_validate_rsne - Validate PSAN specific data of RSNE
3906 * @data: Parsed representation of an RSNE
3907 * Returns -1 for invalid data; otherwise 0
3908 */
wpa_pasn_validate_rsne(const struct wpa_ie_data * data)3909 int wpa_pasn_validate_rsne(const struct wpa_ie_data *data)
3910 {
3911 u16 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
3912
3913 if (data->proto != WPA_PROTO_RSN)
3914 return -1;
3915
3916 if ((data->capabilities & capab) != capab) {
3917 wpa_printf(MSG_DEBUG, "PASN: Invalid RSNE capabilities");
3918 return -1;
3919 }
3920
3921 if (!data->has_group || data->group_cipher != WPA_CIPHER_GTK_NOT_USED) {
3922 wpa_printf(MSG_DEBUG, "PASN: Invalid group data cipher");
3923 return -1;
3924 }
3925
3926 if (!data->has_pairwise || !data->pairwise_cipher ||
3927 (data->pairwise_cipher & (data->pairwise_cipher - 1))) {
3928 wpa_printf(MSG_DEBUG, "PASN: No valid pairwise suite");
3929 return -1;
3930 }
3931
3932 switch (data->key_mgmt) {
3933 #ifdef CONFIG_SAE
3934 case WPA_KEY_MGMT_SAE:
3935 case WPA_KEY_MGMT_SAE_EXT_KEY:
3936 /* fall through */
3937 #endif /* CONFIG_SAE */
3938 #ifdef CONFIG_FILS
3939 case WPA_KEY_MGMT_FILS_SHA256:
3940 case WPA_KEY_MGMT_FILS_SHA384:
3941 /* fall through */
3942 #endif /* CONFIG_FILS */
3943 #ifdef CONFIG_IEEE80211R
3944 case WPA_KEY_MGMT_FT_PSK:
3945 case WPA_KEY_MGMT_FT_IEEE8021X:
3946 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
3947 /* fall through */
3948 #endif /* CONFIG_IEEE80211R */
3949 case WPA_KEY_MGMT_PASN:
3950 break;
3951 default:
3952 wpa_printf(MSG_ERROR, "PASN: invalid key_mgmt: 0x%0x",
3953 data->key_mgmt);
3954 return -1;
3955 }
3956
3957 if (data->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED) {
3958 wpa_printf(MSG_DEBUG, "PASN: Invalid group mgmt cipher");
3959 return -1;
3960 }
3961
3962 if (data->num_pmkid > 1) {
3963 wpa_printf(MSG_DEBUG, "PASN: Invalid number of PMKIDs");
3964 return -1;
3965 }
3966
3967 return 0;
3968 }
3969
3970
3971 /*
3972 * wpa_pasn_parse_parameter_ie - Validates PASN Parameters IE
3973 * @data: Pointer to the PASN Parameters IE (starting with the EID).
3974 * @len: Length of the data in the PASN Parameters IE
3975 * @from_ap: Whether this was received from an AP
3976 * @pasn_params: On successful return would hold the parsed PASN parameters.
3977 * Returns: -1 for invalid data; otherwise 0
3978 *
3979 * Note: On successful return, the pointers in &pasn_params point to the data in
3980 * the IE and are not locally allocated (so they should not be freed etc.).
3981 */
wpa_pasn_parse_parameter_ie(const u8 * data,u8 len,bool from_ap,struct wpa_pasn_params_data * pasn_params)3982 int wpa_pasn_parse_parameter_ie(const u8 *data, u8 len, bool from_ap,
3983 struct wpa_pasn_params_data *pasn_params)
3984 {
3985 struct pasn_parameter_ie *params = (struct pasn_parameter_ie *) data;
3986 const u8 *pos = (const u8 *) (params + 1);
3987
3988 if (!pasn_params) {
3989 wpa_printf(MSG_DEBUG, "PASN: Invalid params");
3990 return -1;
3991 }
3992
3993 if (!params || ((size_t) (params->len + 2) < sizeof(*params)) ||
3994 len < sizeof(*params) || params->len + 2 != len) {
3995 wpa_printf(MSG_DEBUG,
3996 "PASN: Invalid parameters IE. len=(%u, %u)",
3997 params ? params->len : 0, len);
3998 return -1;
3999 }
4000
4001 os_memset(pasn_params, 0, sizeof(*pasn_params));
4002
4003 switch (params->wrapped_data_format) {
4004 case WPA_PASN_WRAPPED_DATA_NO:
4005 case WPA_PASN_WRAPPED_DATA_SAE:
4006 case WPA_PASN_WRAPPED_DATA_FILS_SK:
4007 case WPA_PASN_WRAPPED_DATA_FT:
4008 break;
4009 default:
4010 wpa_printf(MSG_DEBUG, "PASN: Invalid wrapped data format");
4011 return -1;
4012 }
4013
4014 pasn_params->wrapped_data_format = params->wrapped_data_format;
4015
4016 len -= sizeof(*params);
4017
4018 if (params->control & WPA_PASN_CTRL_COMEBACK_INFO_PRESENT) {
4019 if (from_ap) {
4020 if (len < 2) {
4021 wpa_printf(MSG_DEBUG,
4022 "PASN: Invalid Parameters IE: Truncated Comeback After");
4023 return -1;
4024 }
4025 pasn_params->after = WPA_GET_LE16(pos);
4026 pos += 2;
4027 len -= 2;
4028 }
4029
4030 if (len < 1 || len < 1 + *pos) {
4031 wpa_printf(MSG_DEBUG,
4032 "PASN: Invalid Parameters IE: comeback len");
4033 return -1;
4034 }
4035
4036 pasn_params->comeback_len = *pos++;
4037 len--;
4038 pasn_params->comeback = pos;
4039 len -= pasn_params->comeback_len;
4040 pos += pasn_params->comeback_len;
4041 }
4042
4043 if (params->control & WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT) {
4044 if (len < 3 || len < 3 + pos[2]) {
4045 wpa_printf(MSG_DEBUG,
4046 "PASN: Invalid Parameters IE: group and key");
4047 return -1;
4048 }
4049
4050 pasn_params->group = WPA_GET_LE16(pos);
4051 pos += 2;
4052 len -= 2;
4053 pasn_params->pubkey_len = *pos++;
4054 len--;
4055 pasn_params->pubkey = pos;
4056 len -= pasn_params->pubkey_len;
4057 pos += pasn_params->pubkey_len;
4058 }
4059
4060 if (len) {
4061 wpa_printf(MSG_DEBUG,
4062 "PASN: Invalid Parameters IE. Bytes left=%u", len);
4063 return -1;
4064 }
4065
4066 return 0;
4067 }
4068
4069
wpa_pasn_add_rsnxe(struct wpabuf * buf,u16 capab)4070 void wpa_pasn_add_rsnxe(struct wpabuf *buf, u16 capab)
4071 {
4072 size_t flen;
4073
4074 flen = (capab & 0xff00) ? 2 : 1;
4075 if (!capab)
4076 return; /* no supported extended RSN capabilities */
4077 if (wpabuf_tailroom(buf) < 2 + flen)
4078 return;
4079 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
4080
4081 wpabuf_put_u8(buf, WLAN_EID_RSNX);
4082 wpabuf_put_u8(buf, flen);
4083 wpabuf_put_u8(buf, capab & 0x00ff);
4084 capab >>= 8;
4085 if (capab)
4086 wpabuf_put_u8(buf, capab);
4087 }
4088
4089
4090 /*
4091 * wpa_pasn_add_extra_ies - Add protocol specific IEs in Authentication
4092 * frame for PASN.
4093 *
4094 * @buf: Buffer in which the elements will be added
4095 * @extra_ies: Protocol specific elements to add
4096 * @len: Length of the elements
4097 * Returns: 0 on success, -1 on failure
4098 */
4099
wpa_pasn_add_extra_ies(struct wpabuf * buf,const u8 * extra_ies,size_t len)4100 int wpa_pasn_add_extra_ies(struct wpabuf *buf, const u8 *extra_ies, size_t len)
4101 {
4102 if (!len || !extra_ies || !buf)
4103 return 0;
4104
4105 if (wpabuf_tailroom(buf) < sizeof(len))
4106 return -1;
4107
4108 wpabuf_put_data(buf, extra_ies, len);
4109 return 0;
4110 }
4111
4112 #endif /* CONFIG_PASN */
4113